Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1505696
MD5:	2f7a9833af3cdf8be25012f2204e4172
SHA1:	bbdf8ae8039be9b7873e45ebc7782564d2218c53
SHA256:	96183c18f914b3e765227bc2655f4a6e6cc65482ede2c0f09a0c62d0247a67c0
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6932 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2F7A9833AF3CDF8BE25012F2204E4172)

msedge.exe (PID: 6980 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 600 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2136,i,4423155273628034527,7311035686177159598,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4348 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7240 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8512 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7476 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8528 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7504 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8608 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8628 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 8956 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9204 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7476 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4180 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 7668 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 7824 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 7936 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1516 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2156,i,742917363766338702,15304000816538498523,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7004 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7688 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1868,i,12810158684501883132,4649790317243992434,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4364 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3704 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=2108,i,1297920287701116190,17240021859614814705,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.2971610371.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2971610371.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.12.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.12.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.12.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 6e5b7c9a-6043-4704-b8a9-d153fb15aef2.tmp.13.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.12.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 6e5b7c9a-6043-4704-b8a9-d153fb15aef2.tmp.13.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.12.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: file.exe, 00000000.00000002.2971089408.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: content.js.12.dr, content_new.js.12.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 6e5b7c9a-6043-4704-b8a9-d153fb15aef2.tmp.13.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49795 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DFEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00DFEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DFED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00DFED6A

Source: C:\Users\user\Desktop\file.exe

0_2_00DFEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DEAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00DEAA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E19576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00E19576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_163f1a50-1
Source: file.exe, 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_18fe6e18-c
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_16516232-d
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_baf3d01c-f

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DED5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00DED5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DE1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00DE1201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DEE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00DEE8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF2046	0_2_00DF2046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D88060	0_2_00D88060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE8298	0_2_00DE8298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBE4FF	0_2_00DBE4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB676B	0_2_00DB676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E14873	0_2_00E14873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8CAF0	0_2_00D8CAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DACAA0	0_2_00DACAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9CC39	0_2_00D9CC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB6DD9	0_2_00DB6DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D891C0	0_2_00D891C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9B119	0_2_00D9B119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA1394	0_2_00DA1394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA1706	0_2_00DA1706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA781B	0_2_00DA781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA19B0	0_2_00DA19B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9997D	0_2_00D9997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D87920	0_2_00D87920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA7A4A	0_2_00DA7A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA7CA7	0_2_00DA7CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA1C77	0_2_00DA1C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB9EEE	0_2_00DB9EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E0BE44	0_2_00E0BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8BF40	0_2_00D8BF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA1F32	0_2_00DA1F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00D9F9F2 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00DA0A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.evad.winEXE@96/527@20/11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF37B5 GetLastError,FormatMessageW,

0_2_00DF37B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE10BF AdjustTokenPrivileges,CloseHandle,		0_2_00DE10BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00DE16C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00DF51CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E0A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00E0A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00DF648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D842A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00D842A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\b0c48974-cc0b-4d64-b072-c55d018bc060.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.12.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2136,i,4423155273628034527,7311035686177159598,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7476 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7504 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4180 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2156,i,742917363766338702,15304000816538498523,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1868,i,12810158684501883132,4649790317243992434,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=2108,i,1297920287701116190,17240021859614814705,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2136,i,4423155273628034527,7311035686177159598,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7476 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7504 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4180 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2156,i,742917363766338702,15304000816538498523,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1868,i,12810158684501883132,4649790317243992434,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=2108,i,1297920287701116190,17240021859614814705,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00D842DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DA0A76 push ecx; ret

0_2_00DA0A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00D9F98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E11C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00E11C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-96955

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6849

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 4.0 %

Source: C:\Users\user\Desktop\file.exe TID: 6964

Thread sleep time: -68490s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6849 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00DEDBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF68EE FindFirstFileW,FindClose,	0_2_00DF68EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00DF698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DED076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00DED076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DED3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00DED3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00DF9642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00DF979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00DF9B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00DF5C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00D842DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-95981

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DFEAA2 BlockInput,

0_2_00DFEAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DB2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00DB2622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00D842DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DA4CE8 mov eax, dword ptr fs:[00000030h]

0_2_00DA4CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DE0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00DE0B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DB2622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DA083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA09D5 SetUnhandledExceptionFilter,	0_2_00DA09D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00DA0C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00DE1201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DC2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00DC2BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D9F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00D9F98E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E022DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00E022DA

Source: C:\Users\user\Desktop\file.exe

0_2_00DE0B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DE1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00DE1663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DA0698 cpuid

0_2_00DA0698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00DF8195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DDD27A GetUserNameW,

0_2_00DDD27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DBBB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00DBBB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00D842DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E01204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00E01204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E01806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00E01806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	26%	ReversingLabs
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://drive-daily-4.corp.google.com/	0%	Avira URL Cloud	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	Avira URL Cloud	safe
https://drive-daily-1.corp.google.com/	0%	Avira URL Cloud	safe
https://chrome.cloudflare-dns.com	0%	Avira URL Cloud	safe
https://drive-daily-2.corp.google.com/	0%	Avira URL Cloud	safe
https://drive-autopush.corp.google.com/	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://drive-daily-5.corp.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://drive-daily-6.corp.google.com/	0%	Avira URL Cloud	safe
https://drive-staging.corp.google.com/	0%	Avira URL Cloud	safe
https://chrome.cloudflare-dns.com/dns-query	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://drive-daily-0.corp.google.com/	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://drive-preprod.corp.google.com/	0%	Avira URL Cloud	safe
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Avira URL Cloud	safe
https://chromewebstore.google.com/	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://drive-daily-3.corp.google.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.186.65	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	Avira URL Cloud: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.12.dr	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.12.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.12.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.5.dr	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome	content.js.12.dr, content_new.js.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://chromewebstore.google.com/	manifest.json.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://clients2.googleusercontent.com	6e5b7c9a-6043-4704-b8a9-d153fb15aef2.tmp.13.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.12.dr	false	Avira URL Cloud: safe	unknown
https://myaccount.google.com/signinoptions/passwordC:	file.exe, 00000000.00000002.2971089408.0000000000A70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.81.238	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.32.110	unknown	United States	15169	GOOGLEUS	false
142.251.32.100	unknown	United States	15169	GOOGLEUS	false
23.200.0.9	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1505696
Start date and time:	2024-09-06 16:46:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@96/527@20/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 43 Number of non-executed functions: 313
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 108.177.15.84, 204.79.197.239, 13.107.21.239, 13.107.6.158, 2.19.126.145, 2.19.126.152, 172.217.23.99, 142.250.186.35, 2.23.209.178, 2.23.209.182, 2.23.209.187, 2.23.209.177, 2.23.209.189, 2.23.209.183, 2.23.209.176, 2.23.209.185, 2.23.209.188, 20.223.36.55, 172.217.18.110, 199.232.210.172, 192.229.221.95, 172.217.18.106, 142.250.186.42, 216.58.212.138, 142.250.186.138, 142.250.185.138, 172.217.18.10, 172.217.16.202, 142.250.186.170, 142.250.184.202, 142.250.185.74, 216.58.206.74, 142.250.184.234, 216.58.206.42, 142.250.186.106, 142.250.185.106, 172.217.23.106, 142.251.40.131, 142.251.40.99, 142.250.80.67, 142.250.65.195, 142.250.81.227, 142.251.35.163
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-0007.config.skype.com, edgeassetservice.azureedge.net, azur
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:47:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
15:47:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
15:47:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
15:47:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	709827261526152615.exe	Get hash	malicious	FormBook	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	https://www.google.com/url?q=https://google.com/url?hl%3Den%26q%3Dhttps://google.com/url?q%3D4xNZLlTBeMrz3JgT2S2x%26rct%3Duxx6lWWQSQg3lz6tBGEQ%26sa%3Dt%26esrc%3DLnMkARnwEn0HQZmQHxxK%26source%3D%26cd%3DCFK8mnhX1pEg7TmGNG8P%26cad%3DnNq1ozyXGrC1kDZTqknt%26ved%3DYxsBoVntlMlmOm9lZwVR%26uact%3D%26url%3Damp%252Fsushanta.com%252F21%252F&source=gmail&ust=1725491985982000&usg=AOvVaw2OjIR7ELr3F4rLhFIHiJIH#OvyuiE-SUREMAYYcmVpbmEuYXZpbGFAc3RndXNhLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	All-in-one Calculation Tool.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://emails.microsoft.com/dc/e_4JGRIDqcoiTU1HR-giCWWkyCmeORqUCO4pEjpDTddrBVlbCteZJj8QfhFvhzGnrSwkFwZUI8U0ElApY3ruN2moaZlprSDGWrxtrbI1MBxlzIbpGFmlWRXVz-DfjyzMo6DjGJvk2NdT1NgnbRCGzTYRw7PzgS1STErkGqov-2A=/MTU3LUdRRS0zODIAAAGVXrvPPFFO4qk2k5S0WBN6iOmgYzwr15ol9HTLY_vuNwgIljWNKTe4HuyrKAtA0lJBatyTgWI=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://emails.microsoft.com/dc/zSgS2A6q0riGfHtfc6vB4o2EDiQ6lN3O6qiMomONyUJ0HsQ2sZIsMh689GSSYbTLO3mCkWaodie4MAOslvNCWW_9a3plE0P-Ez0LQY78TZmDPHuwNSWhLFzTYMtoZfimsqDGDjfg-w-v-HUlOmaZvGFLFwxVF_4UkVJu8KOKwPs=/MTU3LUdRRS0zODIAAAGVXXQTXko_YJBSIbQm_RlsGLlFgr2A-kJcbF9EmGwaO1zI2Do4ydFFpnBfqgMZYQyQQ3e8Go8=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://dropboxlink.net/082f8223cc1f98d8?l=60	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://buysuhagra.shop/ePFcjxsx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	709827261526152615.exe	Get hash	malicious	FormBook	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	709827261526152615.exe	Get hash	malicious	FormBook	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	lnef.exe	Get hash	malicious	LummaC	Browse	104.21.10.172
	Play_VM-NowMarge.mcintireAudiowav012.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	vjgg.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.10.172
	http://therulecalm.com	Get hash	malicious	TechSupportScam	Browse	188.114.96.3
	1.exe	Get hash	malicious	MicroClip	Browse	172.67.19.24
	EenMhgLlcy.exe	Get hash	malicious	LummaC, MicroClip	Browse	104.21.10.172
	https://link.edgepilot.com/s/13817ab8/2iXyW3oq2EO6IOyhkWFykw?u=https://greatcollege.edu.et/	Get hash	malicious	Unknown	Browse	104.18.11.207
	launch-v3.17.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://lapersianeria.com/mot/a2FyZW5fdmFuX291dHJ5dmVAZmQub3Jn	Get hash	malicious	Unknown	Browse	104.26.13.31
	https://selflove.com/energymarketad	Get hash	malicious	HtmlDropper	Browse	188.114.96.3
MICROSOFT-CORP-MSN-AS-BLOCKUS	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	Factura de proforma.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.107.137.11
	Payment Details.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.107.137.11
	ESW31074TS510.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	PI and payment confirmed Pdf.exe	Get hash	malicious	DBatLoader	Browse	13.107.139.11
	Assessment from SARS.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	https://www.dropbox.com/scl/fo/dypnewy032frqiop6d7gh/AGQRgoJcNqKPbhsYQheP8nM?rlkey=t6ozmhhbporfamqnz8ddx2in0&st=r8w1wv0v&dl=0	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	https://www.google.com/url?q=https://google.com/url?hl%3Den%26q%3Dhttps://google.com/url?q%3D4xNZLlTBeMrz3JgT2S2x%26rct%3Duxx6lWWQSQg3lz6tBGEQ%26sa%3Dt%26esrc%3DLnMkARnwEn0HQZmQHxxK%26source%3D%26cd%3DCFK8mnhX1pEg7TmGNG8P%26cad%3DnNq1ozyXGrC1kDZTqknt%26ved%3DYxsBoVntlMlmOm9lZwVR%26uact%3D%26url%3Damp%252Fsushanta.com%252F21%252F&source=gmail&ust=1725491985982000&usg=AOvVaw2OjIR7ELr3F4rLhFIHiJIH#OvyuiE-SUREMAYYcmVpbmEuYXZpbGFAc3RndXNhLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://app.pandadoc.com/document/v2?token=5aa7b81a431a1c96450cb48fd7928ac947bc5aea	Get hash	malicious	Unknown	Browse	150.171.28.10
	file.exe	Get hash	malicious	Unknown	Browse	52.123.243.83
EDGECASTUS	https://www.google.com/url?q=https://google.com/url?hl%3Den%26q%3Dhttps://google.com/url?q%3D4xNZLlTBeMrz3JgT2S2x%26rct%3Duxx6lWWQSQg3lz6tBGEQ%26sa%3Dt%26esrc%3DLnMkARnwEn0HQZmQHxxK%26source%3D%26cd%3DCFK8mnhX1pEg7TmGNG8P%26cad%3DnNq1ozyXGrC1kDZTqknt%26ved%3DYxsBoVntlMlmOm9lZwVR%26uact%3D%26url%3Damp%252Fsushanta.com%252F21%252F&source=gmail&ust=1725491985982000&usg=AOvVaw2OjIR7ELr3F4rLhFIHiJIH#OvyuiE-SUREMAYYcmVpbmEuYXZpbGFAc3RndXNhLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	Remittance Advice.eml	Get hash	malicious	ReCaptcha Phish	Browse	152.199.23.180
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	709827261526152615.exe	Get hash	malicious	FormBook	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.9
	file.exe	Get hash	malicious	Unknown	Browse	23.219.82.73
	NEOM_SUPPLIER_EOI&QUESTIONNAIR_FORM_SHEET.PDF.EXE	Get hash	malicious	AgentTesla, RedLine	Browse	172.234.222.138
	file.exe	Get hash	malicious	Unknown	Browse	23.44.201.31
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse	23.44.201.4
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.44.201.36
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.44.201.16
	file.exe	Get hash	malicious	Unknown	Browse	23.44.201.27

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Play_VM-NowMarge.mcintireAudiowav012.html	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157 184.28.90.27
	https://mpticketing.logolsolutions.it/	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	http://therulecalm.com	Get hash	malicious	TechSupportScam	Browse	40.68.123.157 184.28.90.27
	https://link.edgepilot.com/s/13817ab8/2iXyW3oq2EO6IOyhkWFykw?u=https://greatcollege.edu.et/	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	https://selflove.com/energymarketad	Get hash	malicious	HtmlDropper	Browse	40.68.123.157 184.28.90.27
	https://www.villa-finder.com/en/api/change-currency/php?redirect=https://selflove.com/energymarketad/&c=1	Get hash	malicious	HtmlDropper	Browse	40.68.123.157 184.28.90.27
	https://www.google.com/url?q=https%3A%2F%2Frb.gy%2Fpqi8ly&sa=D&sntz=1&usg=AOvVaw18MN21n_1ccSXmu4FGZMxe	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157 184.28.90.27
	https://www.dropbox.com/scl/fo/dypnewy032frqiop6d7gh/AGQRgoJcNqKPbhsYQheP8nM?rlkey=t6ozmhhbporfamqnz8ddx2in0&st=r8w1wv0v&dl=0	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157 184.28.90.27
	http://mirrors.fedoraproject.org	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	https://hijauanhills.com.my/wp-content/upgrade/index.php?uid=qvc-communication@qvcjp.com	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70916
Entropy (8bit):	6.073122467903197
Encrypted:	false
SSDEEP:	1536:9MGQ5XMBGgZHLR0spQB2ELP6wfLc2WEaUlPQQib838ocUCgMPamCGhlPnEyn:9MrJM8IHtGBVuwNuUloUDRwywlF
MD5:	8AD2B371618A0737B24ECC16BD2E89FB
SHA1:	7DC3FA939A6D9E98E0530F3BD5A2E2E1E0406C4A
SHA-256:	FAEBDBBB2EB1E34D0645BD7776A0FA785E910E531925B24A858676A2863EE8C0
SHA-512:	4A7E868394B1FB32C64BBC50C177F702F0905FF6D49B0DA1F44BBBD89C84159189A2183B507980158AF6F9AD7971B1FB22648F490F63755B80C9C128BFEE39EE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370107625860857","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1715d9f4-4bd4-4076-bf38-52cb4639bf76.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.5780685715978935
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0af5DX7ZaTnH3skHB+qdrxUvBSDoxR3haJkXgcewlRFCB0:Xq8NkC1f5zGXHBH+viC3MJkQcTwq
MD5:	065BBBC7233AE76DBB80D6E0826A07B1
SHA1:	3D020FFE9C097A5AA50A86ED5D5E97D6DFB7059A
SHA-256:	46620FADE066FEDA60DF8FFBD031EDBB5CCFDC7FB11E266DD1D33BCA80EB51D2
SHA-512:	A33AA6EE57B28B752FF00ED6CC0C4E4B55F15768481154F60B368075126FC6792566F3C766ED17A64A96F12AC4A81F1501FB7C82AEC912F1176C272866B9A7E1
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"policy":{"last_statistics_update":"13370107624374135"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\24903562-e2b0-44c2-9508-cc79025b5cfe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70955
Entropy (8bit):	6.073196510614713
Encrypted:	false
SSDEEP:	1536:9MGQ5XMBGdZHLR0spQB2ELP6wfLc2WEaUlPQQib838ocUCgMPamCGhlPnEyn:9MrJM8LHtGBVuwNuUloUDRwywlF
MD5:	449D1A74FE167BE868003EBFA4BD80FA
SHA1:	F675FA6644D4BADC683A822B3D811C25694B7966
SHA-256:	0C8BA06C5C584A1F0C8B8CBCD79B394C31523A9A0B683EC56BA7FDBC40F0E575
SHA-512:	08240F723766E76F13CAF290CAE4696D35FB8C329868328BA298052EC97E98E4D39C9ED0C8188AB121F4AB01341AD21686AE1F378EB4863CCA6FA95943EFB4E4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370107625860857","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\30f7cce0-e9d6-4f92-ab22-bf2d4fbbbac5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21002
Entropy (8bit):	6.063446374333162
Encrypted:	false
SSDEEP:	384:XtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS64ov0jEQ0XvRv+kWUCGo:9MGQ7FCYXGIgtDAWtJ4nmp0jEQHFB
MD5:	B338107A4943DA0D36F579308486E6FE
SHA1:	23BA1E7410A9D53FAB059D300BB1A0C3F2180F05
SHA-256:	344B78A4EBCBBDE5DEFCD7AE72BEADB5407ECF6EE40BECF2C526612D0DEFA218
SHA-512:	23473ECD815DF1B39E3D6129F1C7587CE44BCC5E71289A05344DA7057A866B57DE6EB88042DC3B9DEAE1A17853B2FE6F7D2274586FB345644EA4455D561C63D3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370107625860857","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\36c608e2-e4f5-4fb1-bb18-41c43cdbe931.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3334
Entropy (8bit):	5.603803622692139
Encrypted:	false
SSDEEP:	96:0q8NkC1f5zGXHNBH+vilWxJkQcoSDS4S4SDS5TI4a:/8NbTzOLWHkQ02
MD5:	7DE65770291CFEFD937CEE95595446CA
SHA1:	08F279E587F2A78EA0C8C772A95CF9187C5AD4D9
SHA-256:	882D566F0FAB792B7D0E1CFED26B532BBA9A8CD6DA19B92DBDAAEB3A74D928AB
SHA-512:	D3E55B46AB62B8CB26E0E6BF059FB081572C28A42965613341F6AF58F49336EF534AC9FF61D4593BD1779882EA86DD66E53BAA97464F42FD5D5C5D65B6A30569
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\43bafc1b-843c-46d4-b468-33659d85e59f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.542426056804702
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcXD+0CHWZaTnU8UXyik5JdXBuBuwBSDaGNhFPjXX1/QQRCYh:YuBqDPaf5DX7ZaTnHEsgBzBSDXVLFYB0
MD5:	ABA90B5CD6C647ECB367BBDE92FA4BCA
SHA1:	C41F5B4B8C08D5D5AAA15EB300A45D8AF60B71B1
SHA-256:	97AE1862516557B8C3F5F5B44588FDFE04DEAFBE3996D2D13F5C0E5FA66F3229
SHA-512:	C5CA86622E398543A13667C11B7335E2656C62274D80D5159A824542760ACD3D4356AB8858CF4333BA380706FE88680B357B787F07CFFC1288C5C95EB507340A
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13370107624329916","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725634024"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4aa6e18a-8a96-47b6-9eb5-2cb38e8341f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4234
Entropy (8bit):	5.48985365486883
Encrypted:	false
SSDEEP:	96:0q8NkGS1f5zGX58rh/cI9URoDoto8RBH+vilWxJkQcoSDS4S4SDS5TI4a:/8NBSTzpeoDUTLWHkQ02
MD5:	C8BBE90FC7A5A34F0F85C5F16639E7F5
SHA1:	4506675FD24728358DA00F4AD0157319337A0E44
SHA-256:	9088E3FBC39D180B68D1A71726382FE178233449BBA0ADEB62997783E08C0707
SHA-512:	269ECBDA5D19EF51C05036403259AEF84D91E24337FE17E36331A88153EE6BAC5E13875BB04412E12CF15EF124F69EC214278D856EE7344872A80361FBC20B0A
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRX

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4c211909-58e3-404a-b7e5-0dcd646c5f6d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21002
Entropy (8bit):	6.063474439851968
Encrypted:	false
SSDEEP:	384:XtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS65v0jEQ0XvRv+kWUCGo:9MGQ7FCYXGIgtDAWtJ4nmh0jEQHFB
MD5:	B081F7E6B1B0139A0994E57C9D0E2859
SHA1:	73C0097AD77683C12206060A76FA59D11D0DCE43
SHA-256:	4FCDE41978EB9BACADA5150A0B03E22D384EE42ADFF3321E7119AF3C74ABBBC0
SHA-512:	A8553D85AEE24C8A364CE6934EA02FC3D1F7ED60834904C1FC44998F66448564D0B548362DA2016D48D7D8D83B51A34A6A30F90B2E337A87CA3011CD865DBDE1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370107625860857","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\85e98e90-9b30-4003-a11a-37e42979d2ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.5780685715978935
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0af5DX7ZaTnH3skHB+qdrxUvBSDoxR3haJkXgcewlRFCB0:Xq8NkC1f5zGXHBH+viC3MJkQcTwq
MD5:	065BBBC7233AE76DBB80D6E0826A07B1
SHA1:	3D020FFE9C097A5AA50A86ED5D5E97D6DFB7059A
SHA-256:	46620FADE066FEDA60DF8FFBD031EDBB5CCFDC7FB11E266DD1D33BCA80EB51D2
SHA-512:	A33AA6EE57B28B752FF00ED6CC0C4E4B55F15768481154F60B368075126FC6792566F3C766ED17A64A96F12AC4A81F1501FB7C82AEC912F1176C272866B9A7E1
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"policy":{"last_statistics_update":"13370107624374135"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\00cc21de-b828-4190-a1de-d74fd21cc46d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66DB15E8-10FC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45720583126452785
Encrypted:	false
SSDEEP:	3072:Ja5UaHdPy/bLMzfpMuUvwa4xkr6fleBFCzQUo1g1HFGy6FwhExZtHaqVet5Af9wF:s/dlxcUo1aHQ/f71HiaHinQ8o
MD5:	DBF388F4E9FA23AA1B9AEF3D7E665D5F
SHA1:	17888DEFB2813CA4EE6A427009617CD31E2873C8
SHA-256:	1FB8F24036C446A8028252E5DA256B6FF93E7FC527F6B0DB8BAAEA5EE47EDE6B
SHA-512:	B84A098A1152DF1AB5FC0FA72EF840CC8D0F5FC135338C48652754BCB9EE883C1229957759C44C6A1CA678598289CA5EFA6A34416A49A110A0BA5DBEB3C535BB
Malicious:	false
Preview:	...@..@...@.....C.].....@...............PX...W..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".usspsy20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66DB15E8-1B44.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.040497186765868214
Encrypted:	false
SSDEEP:	192:wrUjLYiVWK+ggCdKLJtD+1X9XpboUguELUhlwNE1bcRQM9PqBn8y08Tcm2RGOdB:EUjjlY634YhacQBqB08T2RGOD
MD5:	FA9D4B82E8689D5586A551D747BD6E0B
SHA1:	375028049A445B46D2B0CC6AEAD21DC575CFADA3
SHA-256:	D1122676BE64E0ED2DCE4BD09BA5A7AF17F2AF49667BDB7309ED664D0636DA7A
SHA-512:	F979374D58FBC374B5920899A6F1AC0C938F825D09A08CA90121B06EC3BB5379FEB3D5950979E409CFB520A9C1330E358BECAAF5EFFC7BDFBA2A63D38BD97B7B
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".usspsy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@.............+..................1..$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z........-@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.165209323478192
Encrypted:	false
SSDEEP:	3:FiWWltl6iGi5wL+liHSRqOFhJXI2EyBl+BVP/Sh/JzvU1Zp4dHdi/+ltl:o1685w+liyRqsx+BVsJDuO5lX
MD5:	408D8A992EF0A6092FE56E1EE5C4C946
SHA1:	FC213D6F2701CA9FC3712F7295E8AC4D2CFEDED3
SHA-256:	481F834CCD753341F5D2BD520BD6B4995E726416B542C6DB5DBD41463ED69C40
SHA-512:	6F546645E61E44B711B10F6977F9A925C28207F4875905EE22F22F7EE79D7808DCA80901448B6755A0F6FC430065F019A764A019469E7A8E0846F40BBE547F3B
Malicious:	false
Preview:	sdPC....................s}x.=`TG..._...."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................4aa7e515-5063-4ecf-8f59-fd5d3b92869f............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0bdfdee1-09eb-4c46-8139-cacbe6605292.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	4.980542084616451
Encrypted:	false
SSDEEP:	96:stjqfXuis1Hb9OT8N8ztds85eh6Cb7/x+6MhmuecmAeVzZLnQI2Mc/EJ:stjkvsE8Nktds88bV+FiA6PcMJ
MD5:	51D94E5243EC7DEECB44886B21D0E705
SHA1:	564FAE7A5AF61BEF0FC2C0DFFAE2253B92A3A39A
SHA-256:	D01116FE83F52BC28CB008D3C754AFE6E49D6AB0F40AF9A5CF539C8838CA016E
SHA-512:	DB95F371309042C74F6AB30BCF07F012BD4209E8C4BA3F1E9936BAE2434DFE55D6B1AB3F058911BE8141622A45C0681D231194E00E06D4275F54409C0C150D1C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370107625814423","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370107625808030"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\18458cbc-4fc6-44d4-9098-fb5b5802fa2c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566413786525305
Encrypted:	false
SSDEEP:	768:A4XIGNWPjPfYn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRIcGbrwXpGtut:A4XIGNWPjPfYnu1ja4bGwItu
MD5:	D1CEC9B476C0306F9BE9AD4A149D2E74
SHA1:	5145CE120C7C405A605F09E7556890282BF6786F
SHA-256:	54963EEDEB26BD6E3B6505BDBDB7B67F667E929F9588780E5028506E28A4F73B
SHA-512:	9FC170F9677510F0516875F9FD1700533078A11D9DEDF7F160543B11EA51A0DA07925B675640425007780FDF15C949A849DE01BC6782EDABBAAC771C53F53EBB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370107624982662","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370107624982662","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\2014a53c-56c6-4eec-b43c-3d4759f0917b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\410b97b4-da9f-4ddd-9138-4549993755e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.9783068760278955
Encrypted:	false
SSDEEP:	96:stjqfXuis1Hb9OT8N8ztds85eh6Cb7/x+6MhmuecmAeVzUEQI2Mc/EJ:stjkvsE8Nktds88bV+FiASPcMJ
MD5:	C6A3545D0C3A4612A974BE3CAC2578BA
SHA1:	3A910851E6A7BFB5B2A0F150BA4BD699D540C92B
SHA-256:	033FFDC618FBD9FE73C05086169E5D22F0CD9AA1896EF86635609234ACDAFC5C
SHA-512:	FD562821323A27C63AF6F1D4ECD76FCEDFB3EF1E2856D87F5B039EC96B584DBB413A251C6007A3C51219F865E5A7CFC20C33860353A3D75D418616A66D2937F0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370107625814423","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370107625808030"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\622149d6-1c79-40fc-a2fe-63684ffe7f7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9704512010319695
Encrypted:	false
SSDEEP:	96:stjqfXuis1Hb9OT8N8ztds85eh6Cb7/x+6MhmuecmAeVzPr2Mc/EJ:stjkvsE8Nktds88bV+FiAAPcMJ
MD5:	F9657CB4427D233C55A6DF38660E4A0C
SHA1:	3E4E45F7F9BDA3F06E506E5D454A5BAC410DAD95
SHA-256:	8FE734B8ED00B48057BE255DD122B956861E11E83EB79FA8063D352598E9B29B
SHA-512:	BE4516CCA29DEFDBE5D4D948C13F0563A364878B79E123475736828FDD3F036CC7128CBAF8B99DF7810BD46A4089F1D9DDBDC0608C90AE7884A90B91C37D43DC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370107625814423","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370107625808030"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\9e6c6b87-d5d7-47cc-abea-cd7c543db8b5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.320819520877191
Encrypted:	false
SSDEEP:	192:uAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:ROEOKSXs/J7mGnQmLu5/5eNdl
MD5:	8EC2B45024BE6FCE08E8030DE7DA47F2
SHA1:	007C624AFC1477C2285E020E58724059B675B7E6
SHA-256:	F45AC20E91AECCF5A85CDC6ED40F5AF8CC7650D624FC73E5FE43ED9CB097279A
SHA-512:	7AECF5D8CB0EDB9674642B80E225BB8ED4ED77592EE9C074191CA71EEA8387153A4133E666D72729D2C45F2293DFB6594ED0FEFC62727B42012B22C65C49AB68
Malicious:	false
Preview:	...m.................DB_VERSION.1,..h.................QUERY_TIMESTAMP:arbitration_priority_list4...13370107629739269.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.136197688131645
Encrypted:	false
SSDEEP:	6:Pb6T1wkn23oH+TcwtOEh1ZB2KLllmDpDM+q2Pwkn23oH+TcwtOEh1tIFUv:PrfYebOEh1ZFLnmDpM+vYfYebOEh16F2
MD5:	9AAB89C1A179F691F42E7A7AD724A034
SHA1:	DBA56D469BBDFF3693F6829C2EE0AA604E517FF2
SHA-256:	C1EC4D25BF98594A28A9391B86B5856FED3A1365AA8FEA5D28935E10F15D0C34
SHA-512:	28CC857F1F30DE1E75A16D6FBA88B7220A83E64BFBC4B22A048158A98313E2C7CE8DFB3C113005AA53AD55E6FD723E2B826608A361F63803EFCCBD68F4683B8A
Malicious:	false
Preview:	2024/09/06-10:47:08.964 216c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/09/06-10:47:09.065 216c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.04393084004583991
Encrypted:	false
SSDEEP:	6:/Fii2QAvikM/lgFnPTvfmIqiuxGtxqYlcklluxvwxvwC/lc/:dRA/EKPTHrXuAt8S/gqp
MD5:	D6E212EA6363F39C6092104D9311612B
SHA1:	F25028137A4D4BEFBA5C58BF934BFA6B9888A973
SHA-256:	66AA6E617EC78958024921BF9FC53B82A4A0EDA3279243352B4D9A0EC5152BA7
SHA-512:	053252AC36BCE7EFFE34A23C2740045199CC42DEDFC82F2338501355799297218F277F1BE5B3B17C01716AD4660D6F256AF0D5F381BDE293FC8EE265ECA08679
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09573764462058192
Encrypted:	false
SSDEEP:	24:e7rNV4XQ3eaPVHf9V4XeaPVHaUAPnQzLIoMmHVIRBNUeydQzEYblcYT38EWp46:OV4A3esVV4XesrAzNUeyQEYbT3lWp4
MD5:	86E357A900BB0DBC8E0A10C9CF83AF96
SHA1:	0BAB9BB398822E1CD5223B42F62CDFD68BFDF0B5
SHA-256:	08043DF8EA0DDC3E6AF6C8D8DCBE968D945F17F10D5010ABAECCC33F7A1AC208
SHA-512:	BD01798AE84096FFDBA9484C4F284C6A4256FA9BF9E7EF1AE9749C0F4A6AB9F809E943271B934D6B22C4C6E15EAD69CA5523C20C35CCF1B1C73BF71F47341799
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.2830243840557267
Encrypted:	false
SSDEEP:	384:YDlWk5Jtn8lWk5JtnVW42rJtbuGg/JtbKBwJtkz:8sYJt8sYJt0vJtVwJtnJtY
MD5:	2BE52B370477D9166043D80956F38B1D
SHA1:	B65D786B8D00CC3CB0BA928229E7EFD14641973C
SHA-256:	3163EB1E0402E9400CAD7C409F149F4B6B3B8DEE8DC9B4700D99D52B0AA2A4C9
SHA-512:	08F35DCACE214259D287A19280DE690DB18E255FBF60BA5880D7C2243D654A1B2970D1CDC7E47E6DE656AEC880801DB72FC93B377536B1FE48ACE2BC9D590F7E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:Lsul8vlull:Lszu/
MD5:	EF5BB02D0F1AAD850635E6E51CE49593
SHA1:	48D6002BF94C400957455783B389EC05ACD08904
SHA-256:	20802083CE080D641F5AC540C3B29DE2578F853286CEB01E518F6E2DFEFED606
SHA-512:	12913531F72C624136B4E3993C0AAA2083CDA2EB3AB5BE9DEE18927B805E3CF9B3A80C6B6BC927276CF066330CFD02A1B64664F47F9B01997BDD2E7A96CA2BAE
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:H57X00EgF+n:ZXgY+
MD5:	240CEE8BFD4B3EE56CF633D4C221A390
SHA1:	E128BF78092E90A88BD5493B5CC4260E11A91085
SHA-256:	2239C41E00E5F8A3529CB6C09101257C9CD43052CA181E4043F289A4E72597E6
SHA-512:	5EBD9CFBB822C163E7ADB7E135BD9B944D1264CD4A71A20BDB0536EAA51975FB001F83B032616BEEFC7F93D15ECA649E0EB278AE6FCAD5324CF6FEC4B5F64B1E
Malicious:	false
Preview:	(...Z...oy retne............................./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:H57X00EgF+n:ZXgY+
MD5:	240CEE8BFD4B3EE56CF633D4C221A390
SHA1:	E128BF78092E90A88BD5493B5CC4260E11A91085
SHA-256:	2239C41E00E5F8A3529CB6C09101257C9CD43052CA181E4043F289A4E72597E6
SHA-512:	5EBD9CFBB822C163E7ADB7E135BD9B944D1264CD4A71A20BDB0536EAA51975FB001F83B032616BEEFC7F93D15ECA649E0EB278AE6FCAD5324CF6FEC4B5F64B1E
Malicious:	false
Preview:	(...Z...oy retne............................./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:D9b0QR0EvR44:99v9
MD5:	EFB40100C559E93F5E181C8A243B981C
SHA1:	21742F3336A49F275A0440482DECEDFB9EC8B29C
SHA-256:	A13ABBEC10F9DEA3A986D85929EE2C1809665C34B7EA041043764E95C7D419B5
SHA-512:	70F1F238170FC417144BE5EC477346199F0C778EF6B528236142A418CD4D18D5C7364D4D5C7F84A11DFB4D4E0A403E931EE70A918D4278AD244FF87FA43EF3D5
Malicious:	false
Preview:	(...^..oy retne........................s...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:D9b0QR0EvR44:99v9
MD5:	EFB40100C559E93F5E181C8A243B981C
SHA1:	21742F3336A49F275A0440482DECEDFB9EC8B29C
SHA-256:	A13ABBEC10F9DEA3A986D85929EE2C1809665C34B7EA041043764E95C7D419B5
SHA-512:	70F1F238170FC417144BE5EC477346199F0C778EF6B528236142A418CD4D18D5C7364D4D5C7F84A11DFB4D4E0A403E931EE70A918D4278AD244FF87FA43EF3D5
Malicious:	false
Preview:	(...^..oy retne........................s...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlO/ll:Ls3O//
MD5:	1BEBDAE762CD19EB3FACE10495CD8D70
SHA1:	6C74EF3F24E06B90C3B6DC0699D8E12AE6C61FC2
SHA-256:	D09E55F955D816567B4CC38E8F29BFAACDF987C4E54882F8D58B37D23EF45A71
SHA-512:	ECC095BD268418F87EDBD3718E674CE766AD79ACFBC4C41D33DA80504C4563E797626B0A4C68149312FCBD96FC9614E843D86E354A43FBAF0F34E4912EA10E8A
Malicious:	false
Preview:	.........................................{..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354164072825661
Encrypted:	false
SSDEEP:	6144:tA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:tFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	BEC54DD84E91C141AB3AE048E2B05ED6
SHA1:	3D815D66BAB6CDCCE91D5922E889284FDA11B52F
SHA-256:	18B3396610C72A33A0891FFD9D44F248BF126FA140C544F3D5E6133E532AB32B
SHA-512:	F542E96306D33BABC57F583A1C23584C1C54AE93DA75FEC8C459B73449CCCA877DEDDD0461A28DB29035FAC45B0066DF6B9FF37A40B69EAB37020A58DA151654
Malicious:	false
Preview:	...m.................DB_VERSION.1...q...............&QUERY_TIMESTAMP:domains_config_gz2...13370107629761590..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.209838894624241
Encrypted:	false
SSDEEP:	6:PbU+q1wkn23oH+Tcwtj2WwnvB2KLlluA+q2Pwkn23oH+Tcwtj2WwnvIFUv:PV1fYebjxwnvFLnuFvYfYebjxwnQFUv
MD5:	A3FE5CD14760AD2CA3AC5D466E8C35F2
SHA1:	2428B26B35D73A0C0BF8E1DFE8301822F39FEEB9
SHA-256:	8FE7F946FFA7B9836E27D496010BAAEEA11C8A8656FC9B06741F1D0367BA1AA7
SHA-512:	92E0F1C1FB001756B4775EFA94F656E5B7F57CAA24CA5CDF05005657F7AE54582B3277F0EF59FAF91CFE769107ECDE7EEEF16D891EF4B7474C2475C543F839FE
Malicious:	false
Preview:	2024/09/06-10:47:08.978 2188 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/09/06-10:47:09.079 2188 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.32460959437421
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Ro:C1gAg1zfvQ
MD5:	04A6046DC1BEFBEDC9D49439FC0CBA5B
SHA1:	C9E59E4A753010556643651EDBB4AA944AD1E9D0
SHA-256:	8EB864A3A3872CA5188E271558C81D5D0959AE21C1A52BEBEE282F64A7B46324
SHA-512:	B3692519B309650363C2D951C7A4618C4D4983FAC79DAA8485932F7CD18849789139F804816439138193203AE3250F3E474870691D5BCAD87737568B6327AC4E
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.171512882955076
Encrypted:	false
SSDEEP:	6:PUfFERM1wkn23oH+TcwttaVdg2KLllU4Fq2Pwkn23oH+TcwttaPrqIFUv:P9RrfYebDLn/FvYfYeb83FUv
MD5:	9C2D300C826CA273E65569B6D1D323F1
SHA1:	2EE13C82F7F83A49C9010E4CEE22E73BE55A27F3
SHA-256:	21476BAFE94EF34E4DBBF259E9E11B7DB74D7345381DBB57F7C5D423F11A10E9
SHA-512:	402F7EC0E6A09313FF729F22B56A68703C340B2FBA307D349EC32276C981A6BFAFBD999DFDF32C7D55C42036C507E6A52D0D36651326063AA0C2BE5508C09106
Malicious:	false
Preview:	2024/09/06-10:47:05.015 1c24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/09/06-10:47:05.024 1c24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.176093880942266
Encrypted:	false
SSDEEP:	6:PUmFERM1wkn23oH+Tcwtt6FB2KLllUTq2Pwkn23oH+Tcwtt65IFUv:PkRrfYeb8FFLn6vYfYeb8WFUv
MD5:	D5FA90753A63F53D22C0448C8B06EE63
SHA1:	D36924B146C08A0932423CC59FB713268BFD7ACD
SHA-256:	953A5A1CE297BC032EACE1277F2CBE756B5DAA1FACA7E30975AF4D53A1187953
SHA-512:	4A78EE8C5DE2CEFBB608C410630A7C7B9D94E3195CC3BED095C59BF28881090089A44AD67E1C3C0308F0C02DCAFE761D2CA7AC0F29B8C75A1D121DEFC366B26E
Malicious:	false
Preview:	2024/09/06-10:47:05.025 1c24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/09/06-10:47:05.036 1c24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.12164574425335
Encrypted:	false
SSDEEP:	6:PVhEds1wkn23oH+TcwttYg2KLllVhHOq2Pwkn23oH+TcwttNIFUv:PVhEVfYebJLnVhHOvYfYeb0FUv
MD5:	522E957BF348C8842100D2699A019E2F
SHA1:	83385DE22A51B0853097A79EBBF01F13607E0B76
SHA-256:	405875AFBEF16E02900DCC19C1F60398C8ED3BAD7E7E20402818C9FEAD66640D
SHA-512:	1F49F689A2880FBFA0BD0306E4DB145DB5716118C0504FE78C781C9BA6F8CEE64503C18BCF3FD2BA204F0461D764ED31CA5A841A0ADF8FDDA4816569CF0EF73C
Malicious:	false
Preview:	2024/09/06-10:47:06.060 1470 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/09/06-10:47:06.071 1470 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNloYQ/lll:Ls3o3/l/
MD5:	85AFF88A7004B8B30108CB5CD9BCDA4A
SHA1:	9DA65E908A0478433B6C2D791574E568CEF5FFA1
SHA-256:	A29931E0BF4AD29EBAA2B9D2B8A46084C17EDCD6F04499D8F9A3B52280C43CCC
SHA-512:	BA6F0D1B19DAC9FE86AB2EA0B658E953D1DEE73CBEE5C33C174E56C4C9A6505F4C770C0041EEFB98CE806428ECA5F6E94A7FFF2C52865B79F70D04546FB2E571
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789765
Encrypted:	false
SSDEEP:	3:GftFlljq7A/mhWJFuQ3yy7IOWU2m2lQdweytllrE9SFcTp4AGbNCV9RUIxB:GU75fOUm2lQd0Xi99pEYjB
MD5:	1D44802A12479DE27C601B1ED43B1DF1
SHA1:	7CD49013A10078F50F1FFA503CC675F5C5276DBF
SHA-256:	D90E6EF473BC99C553D6B2B89C497D22EB41FA209BF33C611C51C5EB36642A73
SHA-512:	C147322DB5641D39CE93C1D995D25DF002E477EB78442ECE69146D96C450345BA63E85C7C862CFBDCCB3343AF3BCF7EEAABFBBB9424D8EA34941D993B930F18D
Malicious:	false
Preview:	..............C....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.200881587337523
Encrypted:	false
SSDEEP:	6:PC1wkn23oH+TcwtRage8Y55HEZzXELIx2KLllxxq2Pwkn23oH+TcwtRage8Y55H0:PdfYebRrcHEZrEkVLnxxvYfYebRrcHEz
MD5:	2D922F0B255F83DD1CC67B4F088D1B5A
SHA1:	D2316E9C73CCAFC8A6F500F410DF9E49B2EAEFD2
SHA-256:	E605D78BE52B44FAEB3B97E7BA65C247ACD64199C7D9204938730C9DF21D0B7C
SHA-512:	19CAC8BBF7CF085E2F2A07BF16AA5305AF3A672479164B5F95539996008DBE6BDFC95995B1D259684EF2A748F546600E2DB4A2DD9589CB64174083D690206DB4
Malicious:	false
Preview:	2024/09/06-10:47:07.056 17a0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/09/06-10:47:07.074 17a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.233019506190079
Encrypted:	false
SSDEEP:	6:P8F8F+q1wkn23oH+TcwtRa2jM8B2KLlljHN+q2Pwkn23oH+TcwtRa2jMGIFUv:P8SyfYebRjFLn8vYfYebREFUv
MD5:	B81C2EFE0BD16779E8D9FA222EE93B74
SHA1:	015CA36BFFC558567814B485C20DE3E7BC88E2EB
SHA-256:	6563E1008D54A05865581F73E69A371E442ACB8AC7D13F50911D5A428F383B77
SHA-512:	02E4FB8033D55553990F5B375FE32D3AAF12FAB6FE031FB3C761586E34FE60F426DEF1682FA948AF8EE36824D926010D4EF224EEAD3F7C71DB79DF5E6CD07B87
Malicious:	false
Preview:	2024/09/06-10:47:05.329 1ca8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/09/06-10:47:05.356 1ca8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\224d56c8-d4a9-4058-9a42-064f9e5a6539.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\2f5b29cb-29a7-48e0-bdee-8d8cd67ba7b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\62cfee1f-03ce-4626-9c0f-7c8725176acc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3c881.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7608166510000912
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBk7X:uIEumQv8m1ccnvS66
MD5:	ADBF82C5D8CA397C743772ECB16123E5
SHA1:	5AACB86199D119410883861A01AD681A75609CA6
SHA-256:	E79512D185DBDF03996B3644612392A412649FD5B4F4194F3406402721072B74
SHA-512:	64D5F44CE027E38A1AB60F45DEE2C40543EE90C45D08721843D07C1D7338C19759F2F04170273E63D29B4F23E49CA7016CFED68471A18E053CB30A6A339917B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF2a761.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\b01ddc69-5223-4794-9535-2a3eaa7c7356.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\e1cbfe8c-c6a4-48fd-8629-f8fab66e35df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9704512010319695
Encrypted:	false
SSDEEP:	96:stjqfXuis1Hb9OT8N8ztds85eh6Cb7/x+6MhmuecmAeVzPr2Mc/EJ:stjkvsE8Nktds88bV+FiAAPcMJ
MD5:	F9657CB4427D233C55A6DF38660E4A0C
SHA1:	3E4E45F7F9BDA3F06E506E5D454A5BAC410DAD95
SHA-256:	8FE734B8ED00B48057BE255DD122B956861E11E83EB79FA8063D352598E9B29B
SHA-512:	BE4516CCA29DEFDBE5D4D948C13F0563A364878B79E123475736828FDD3F036CC7128CBAF8B99DF7810BD46A4089F1D9DDBDC0608C90AE7884A90B91C37D43DC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370107625814423","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370107625808030"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF33a2c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9704512010319695
Encrypted:	false
SSDEEP:	96:stjqfXuis1Hb9OT8N8ztds85eh6Cb7/x+6MhmuecmAeVzPr2Mc/EJ:stjkvsE8Nktds88bV+FiAAPcMJ
MD5:	F9657CB4427D233C55A6DF38660E4A0C
SHA1:	3E4E45F7F9BDA3F06E506E5D454A5BAC410DAD95
SHA-256:	8FE734B8ED00B48057BE255DD122B956861E11E83EB79FA8063D352598E9B29B
SHA-512:	BE4516CCA29DEFDBE5D4D948C13F0563A364878B79E123475736828FDD3F036CC7128CBAF8B99DF7810BD46A4089F1D9DDBDC0608C90AE7884A90B91C37D43DC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370107625814423","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370107625808030"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF3af3c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9704512010319695
Encrypted:	false
SSDEEP:	96:stjqfXuis1Hb9OT8N8ztds85eh6Cb7/x+6MhmuecmAeVzPr2Mc/EJ:stjkvsE8Nktds88bV+FiAAPcMJ
MD5:	F9657CB4427D233C55A6DF38660E4A0C
SHA1:	3E4E45F7F9BDA3F06E506E5D454A5BAC410DAD95
SHA-256:	8FE734B8ED00B48057BE255DD122B956861E11E83EB79FA8063D352598E9B29B
SHA-512:	BE4516CCA29DEFDBE5D4D948C13F0563A364878B79E123475736828FDD3F036CC7128CBAF8B99DF7810BD46A4089F1D9DDBDC0608C90AE7884A90B91C37D43DC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370107625814423","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370107625808030"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566413786525305
Encrypted:	false
SSDEEP:	768:A4XIGNWPjPfYn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRIcGbrwXpGtut:A4XIGNWPjPfYnu1ja4bGwItu
MD5:	D1CEC9B476C0306F9BE9AD4A149D2E74
SHA1:	5145CE120C7C405A605F09E7556890282BF6786F
SHA-256:	54963EEDEB26BD6E3B6505BDBDB7B67F667E929F9588780E5028506E28A4F73B
SHA-512:	9FC170F9677510F0516875F9FD1700533078A11D9DEDF7F160543B11EA51A0DA07925B675640425007780FDF15C949A849DE01BC6782EDABBAAC771C53F53EBB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370107624982662","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370107624982662","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF30792.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566413786525305
Encrypted:	false
SSDEEP:	768:A4XIGNWPjPfYn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRIcGbrwXpGtut:A4XIGNWPjPfYnu1ja4bGwItu
MD5:	D1CEC9B476C0306F9BE9AD4A149D2E74
SHA1:	5145CE120C7C405A605F09E7556890282BF6786F
SHA-256:	54963EEDEB26BD6E3B6505BDBDB7B67F667E929F9588780E5028506E28A4F73B
SHA-512:	9FC170F9677510F0516875F9FD1700533078A11D9DEDF7F160543B11EA51A0DA07925B675640425007780FDF15C949A849DE01BC6782EDABBAAC771C53F53EBB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370107624982662","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370107624982662","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.118817007895045
Encrypted:	false
SSDEEP:	6:P7hq1wkn23oH+TcwtSQM72KLll7KfA+q2Pwkn23oH+TcwtSQMxIFUv:PPfYeb0LnaFvYfYebrFUv
MD5:	F6531D1D27F1A9A77C8BB32EF11C3249
SHA1:	7D8D4EBCBB6A03883FB37139C04C6A3E8AC18BAA
SHA-256:	BD26DB2C89970E86423F74BC9E1D51E237DD2AEFE29E6E579BF8A846549D0F1D
SHA-512:	D5A56B88232A8D166B570BB95B2C1613D781CD058A950F0242F2A4FE3BD8CE3C9C7F29B5272902B6B0EC04F740E55F16A90715BFAE734CD1CDB3F848755964FE
Malicious:	false
Preview:	2024/09/06-10:47:22.040 1ca8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/09/06-10:47:22.061 1ca8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.117050676494175
Encrypted:	false
SSDEEP:	6:PXVmRq1wkn23oH+TcwtgUh2gr52KLllUvw+q2Pwkn23oH+TcwtgUh2ghZIFUv:PFmbfYeb3hHJLnG1vYfYeb3hHh2FUv
MD5:	8300BD9BB2E066945AD430848652F35F
SHA1:	1BECC759D53E809DD93BE716D0C8B0B3C5AF8892
SHA-256:	EF0EE76E1CB19449292B3B28C814BBF7594751B614DE85EFEBBB74FA87ED7210
SHA-512:	3233D4DC24578415A878FA687B8B0A71B3DF3BD268210D4EB452CF6775207E0E9E5A852B6D18A7C8ED8FC2AF6A8807054878278BE644381EF9569E5AB3E1025D
Malicious:	false
Preview:	2024/09/06-10:47:04.997 1c18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/09/06-10:47:05.011 1c18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:LsulLUPlll:Lsvl/
MD5:	5D50DA88F243155BEABAC51519D999B4
SHA1:	002C5576AA47854A5A3E71973F75D1B37F66E65B
SHA-256:	4D1752D470445055B877BBFCDAE143A5B5DB11C9DF4EF58C6BBA420E9B30967D
SHA-512:	D71C556531BBDF4E775568FD36DD7164070333AE93E0E35A4853459CF4F9EEE5196BD4B8C2DA9981AF3504E6BE05B78E66CA76D8A2689C056A2139C6D22003B1
Malicious:	false
Preview:	.........................................7..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:4cNAR0EPF:4hPF
MD5:	87F783083A90382B4C8FE8ECC93FE354
SHA1:	C27828754AD2020F09A20E26FA483C1512A31D2F
SHA-256:	7B758F0EF406DFA46C7587E294DE6F1EB68A8DCD22D6EBBB8EF3EC6825BD07C4
SHA-512:	8C5BD961A73F4B9CD19F71C4BE90B138EE96FCC1427ED369E3D3DDC1B18C8D3E77351B793157CD97EDDF43088797D6197963818028F51BADF5A5378FA9E68C21
Malicious:	false
Preview:	(......oy retne........................S ..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:4cNAR0EPF:4hPF
MD5:	87F783083A90382B4C8FE8ECC93FE354
SHA1:	C27828754AD2020F09A20E26FA483C1512A31D2F
SHA-256:	7B758F0EF406DFA46C7587E294DE6F1EB68A8DCD22D6EBBB8EF3EC6825BD07C4
SHA-512:	8C5BD961A73F4B9CD19F71C4BE90B138EE96FCC1427ED369E3D3DDC1B18C8D3E77351B793157CD97EDDF43088797D6197963818028F51BADF5A5378FA9E68C21
Malicious:	false
Preview:	(......oy retne........................S ..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:wp7gc9EcSNVn:wpscqxVn
MD5:	F648BD07A712463595DFE545ACEE0606
SHA1:	7D2D3C3C48B53534B492960290A82EE6CEAD9FFA
SHA-256:	472FB3ED19F5030340D51BE7A8CD1609CB80024D650A4025E33BCE1BB67E80FC
SHA-512:	8EA1EBA2E5BDA5FEE62BFCA5CBC1D40D1B3C14F73018F1B088BAB076861B8E1183181016872E50811F25B0830EFFF775346AFDC734103634C6F3CAF065E90DCE
Malicious:	false
Preview:	(...mL..oy retne........................@7..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:wp7gc9EcSNVn:wpscqxVn
MD5:	F648BD07A712463595DFE545ACEE0606
SHA1:	7D2D3C3C48B53534B492960290A82EE6CEAD9FFA
SHA-256:	472FB3ED19F5030340D51BE7A8CD1609CB80024D650A4025E33BCE1BB67E80FC
SHA-512:	8EA1EBA2E5BDA5FEE62BFCA5CBC1D40D1B3C14F73018F1B088BAB076861B8E1183181016872E50811F25B0830EFFF775346AFDC734103634C6F3CAF065E90DCE
Malicious:	false
Preview:	(...mL..oy retne........................@7..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNld4/ll:Ls3e/
MD5:	89462565DF988BEAE07B2F63EA0D264F
SHA1:	FD387FDAE96B8C1B53B52B99772FBD3D98690ABE
SHA-256:	C42FC50A9C616FC7F94A34A072E8C83E34337706A0E9C886B09EACCCC9AE2023
SHA-512:	0F41461361D0A65F9F32122F943E6067AD7E3203FB642004234121FD9AF5C8C0C6132C36518DE42676189E00A4860C43707A6CFB4E57F6FBCC8302F42AC2851E
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlkJmol/ll:Ls3kX//
MD5:	7CE27E162E99080C16869A265DEE14FD
SHA1:	ABDB591801410A2A69B6856003D84D226C6A68B7
SHA-256:	CF2ED968FC37B8DE2339B3F66D5A86A1FDDD634E1D0CCBE1F69403C30B4B291B
SHA-512:	123D0EF33CCCEBC41272FFF6FF811345854AE212479CAF2A22626C4688C28479513FAF5C50290B98376601775008D94C79250A8F18C071B3BED92172A60D91E6
Malicious:	false
Preview:	.........................................4..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.221965776299188
Encrypted:	false
SSDEEP:	6:PVhYJhq1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLllVN+q2Pwkn23oH+Tcwt0jqEKjl:PVhILfYebqqBvFLnVIvYfYebqqBQFUv
MD5:	436B06ADCC221E89ACD84700B47F8F92
SHA1:	5AFD3A7412EDFD181B3414C05EC45A41BA44DD57
SHA-256:	11F6B1E02704440BBF1813FF66D84EB3106CFE5CDCA48A443C3DADC41A50E71D
SHA-512:	E235D701B80CCEB948E73086961D4C96C86766983C6DB0942FB9C984D6C78D12EFD94CCA0DA2112E7B512FB8DC38271B0586B1EC68BAD27AE99898091BB14436
Malicious:	false
Preview:	2024/09/06-10:47:06.061 1ca8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/09/06-10:47:06.397 1ca8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\12f18b9c-fa22-4817-ae20-0747b00b91ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6898bdac-6f41-430c-a2d4-eb9683a32009.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3c8cf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b6399429-a3ac-498a-89ad-a11b81a534ac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f1434895-55b6-4d3f-9f6a-15ba9857a6a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.192665426015788
Encrypted:	false
SSDEEP:	6:P7Eq1wkn23oH+Tcwt0jqEKj0QM72KLll73FsHN+q2Pwkn23oH+Tcwt0jqEKj0QMH:PYfYebqqB6LnPvYfYebqqBZFUv
MD5:	95EBBF39407286F41E37AA7EEC161CF7
SHA1:	8C717F9757DD7945D047881B889593F02D6D3235
SHA-256:	78EF74FAD08E451DC34AF5E46F4EE5DB16DFDE649A0A4F3C0893E292CA4B58F0
SHA-512:	5D1F3AAAC6D4C23250E17DD7809283AE6F9C3DF394B742B08389CA0D0A19327521F03F2E8F3173A60E9DF7AD099E66F00DF775F68FBF5FD4D08D4959416A1590
Malicious:	false
Preview:	2024/09/06-10:47:22.078 1ca8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/09/06-10:47:22.114 1ca8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.19508543561765
Encrypted:	false
SSDEEP:	6:PU0ms1wkn23oH+Tcwtkx2KLllUhOq2Pwkn23oH+TcwtCIFUv:PafYebkVLnwOvYfYebLFUv
MD5:	836C350A2CC50D8249BDD43FFEB966C5
SHA1:	63B6C5F06EEF793D4BAF2408AF80A2291E7611DD
SHA-256:	9FC5EF8C2C07850C0356905EC503D60F217BEF97E3A6B0FD449C1A89145C4EF0
SHA-512:	55E0BAFAEA4B3EF5D25DFFB17340C0793BB57578A06CB215E776DDC73F1D374F22C14F663E6BA8E48A0A912C8CB1AB7A984A2827089053F480046F94F6CBC9E5
Malicious:	false
Preview:	2024/09/06-10:47:05.001 1470 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/09/06-10:47:05.015 1470 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002095330713584969
Encrypted:	false
SSDEEP:	3:ImtVxS///:IiVxi
MD5:	2AC034C70D461B4DDC9FD56A21C0AE1D
SHA1:	4184472FA40A7748820425512F4A7FA6E1C1225F
SHA-256:	4BEDE95FB1F72D6F09E45961F5DA13D2EFDE7520BE16EFF5B07FA5F325271CBE
SHA-512:	8B4CA764215F27A2E992066D3AD58B635A9A1191A8A01B2DF2ED82FAC8B0F2DCB8951694832AE24817574335AB8E1072BE706DD60999A83A3D521DAB3425F866
Malicious:	false
Preview:	VLnk.....?............~.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0771714041090907
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOTtSAE+WslKOMq+vVumYWHn66:e/2qOB1nxCkOTtSAELyKOMq+vVumpp
MD5:	1DB4DBD729E198CE5585517688F12FAB
SHA1:	659BEAC88CC7F3F75C7ABEA0C17E2197DF8D6601
SHA-256:	E33D4F83126CD5E6F91F8CC7C2FA293C2D7070B1307376456F72DF3B956BEBB4
SHA-512:	E51BD91050BCA0C929A98C874A2BC195874F96910A78F54B416FC010EB362A02B3C61566DA90EDF0763F2FB6921C27C3F160C679D02685C66FDAF13620270DB3
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\e583e39d-1faa-4318-9aeb-19a319b48d01.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.566400856786566
Encrypted:	false
SSDEEP:	768:A4XIGNWPjPfTn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRIcGbrwLpGtuI:A4XIGNWPjPfTnu1ja4bGwctD
MD5:	71F5D893552CBE13631A2499ACD91C35
SHA1:	34236C4708B08BDDF387CB519E59D8395B67C210
SHA-256:	DB9C8431B07A8DD40873DE42DDDEC34CEFD189521A73D5617B489E67929D31B5
SHA-512:	A8C7294D4C96E44316AA746D30429223BFBFD7451548144ABF4C95C01DBCD2D1702E98C90671BBCB7A96AEDD6F74F6C370F647AC0C895823B83E825E7F0436E2
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370107624982662","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370107624982662","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/TZ2G/l/lFll:7+/l/TIG/
MD5:	D5204CC689DCD40BA0E1D31E8D0FE589
SHA1:	16C1740769D35B7FF7C003A6530842688C1F13B9
SHA-256:	FF9C8BC1B74A34F0B66CC2CAFE8CE82A76BC3A51F369834330C6277A93D87DE3
SHA-512:	09498797F5D7EFB685D10F3F4EA4E5ACE742279FF6ECC6114487AF403B99161050A7D05F2B3A31C4E7C8D047711E0637D42D732004A9AD2465D332DA6722FFDC
Malicious:	false
Preview:	.... .c.....v\|.7................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.049975295215536605
Encrypted:	false
SSDEEP:	6:GLW0LxnTW0LxO/CL9X8hslotGLNl0ml/XoQDeX:aLJL0/6GEjVl/XoQ
MD5:	132C5DAF852264013851616B3A31140D
SHA1:	34786658079293299F9B76516944AFBFCFF5E0A7
SHA-256:	5F0ACDE7F320AC4EAC803A7CED6FCF4649996C3E600166FCCAF14185272D1F6C
SHA-512:	2D579DA1472EE761E3EC7BA25376EC94F859B04983C9CB9476E1B4FD54662E44CFFD556281AB8E34578214B34D79004C5B09379899DF73B1E5B57E13138604F2
Malicious:	false
Preview:	..-.....................(...Daf9.e......gPuB..!..-.....................(...Daf9.e......gPuB..!........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9981676117608232
Encrypted:	false
SSDEEP:	48:Azx0tM/lO+mcbX+Nn9VAKAFXX++2VAKAFXX+LxOqVAKAFXX+pnUYVAKAFXX+j5Sc:QxtXweNsKNsdO5NsQNsj5d
MD5:	6F29C1B4C8089E41D267B7A595BFDC21
SHA1:	303A8A7D4B0AF8DD00269F68C504F37430C0094C
SHA-256:	02B330CC705ED2222E18BB9725B02EF8F9C4493E82AE65C1534E720993376267
SHA-512:	7F341DDAE647BC3D5A3E192291B9B5D2D754E2A19E0B9CB6974BF8178E2A9202450F4909BD50CC951A2028333D7759DC257976F8A9E52D9F0A336254AA07F341
Malicious:	false
Preview:	7....-..........9.e.....^L.L............9.e.....A.......SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.499216780610737
Encrypted:	false
SSDEEP:	48:gZI8RSBSeQ9PwHRH2xEIYjIYmzGqkjMYjMY+qyFAlkfAlkL3:t0eQKIYjIYmzGbjMYjMYSYcYe3
MD5:	B5859CE870CB29D6B421488DDF774C92
SHA1:	264AC615110865B6B99D761FC5E86C0E9911CF4C
SHA-256:	58AB6FFD880405F9CB2D9D0147EC0C7F0FDFEE0919C440BD723016AC9920EA78
SHA-512:	147F2C923D7EEDB943E497F8B6C6535F23B9837829EBE51F7A01C853464A8FB5A0066F9CE0BAA02EB55FC5F4DEEB8CD798EC790B99DD5A639333921C079E0F30
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f.................&f...............K./..................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.225258229029053
Encrypted:	false
SSDEEP:	6:Pa1wkn23oH+Tcwt0rl2KLll2xq2Pwkn23oH+Tcwt0rK+IFUv:PlfYebeLnMvYfYeb13FUv
MD5:	3A5EC467C289AF57BDFEE9553DABB3AC
SHA1:	FCF548337E74F4FA422A5C5950C8ACC3506416D7
SHA-256:	B6E1212F57F31295D70BB976B16170A8C763B2BA50F10C2F217CA37A3A8E3198
SHA-512:	FAE7833C1FC5575038C884C0C6259DB0C332B954D3464C024ADBE0DB9D023C566EC59FD757F63A4B9333534EC4A4A03805526C75A29AAC312C912A367489D5CB
Malicious:	false
Preview:	2024/09/06-10:47:05.502 17a0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/09/06-10:47:05.745 17a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	3.9286030169082573
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/A+iPAm+KglS5PMRoFX2Ogp8mvRU0:G0nYUtypD32m3LiPP+Kt5Ttw
MD5:	25800E5C2DE4DD16EF75999AEB719D32
SHA1:	46D6424035EC9605E056005FB67ED2AE1452D302
SHA-256:	8B73FAD2FAC4F7ABDE6E732013C027F31872D05B60DF8CEBBAEA563822402BB9
SHA-512:	C12A250A37178E4B19CC19DC459014965A2D5879EF5FA880C3EA10403A1C588CFE63668D984C561F873E278511B30AE68B7C8A250E61828085DD6ED02A894D4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......Q...................20_.......w<.................20_.......ln.................19_......t...................18_..........................3_.......:@.................4_..........................37_.....9 '<.................38_........J.................39_......ort.................18_......A@8.................3_......a...................4_......@o..................37_.....n5._.................38_.....LZa..................39_.....D...................9_.....^...................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.194266822398128
Encrypted:	false
SSDEEP:	6:PQmg1wkn23oH+Tcwt0rzs52KLllQlq2Pwkn23oH+Tcwt0rzAdIFUv:PbfYeb99Ln4vYfYebyFUv
MD5:	3D3B9FDA38B0871D6D09DB8A6020C721
SHA1:	82C7554DE6B3202B1A9616D3654D140A8A7CC1CA
SHA-256:	91D211F23FE258B8A4E76D37F3A5EEA389ACAB524CF6022450EA156F8000AAAB
SHA-512:	CF3B2189DE4AA233EEBE4AF48056417730FF3279E2950FD37E7F3F0F1A926E2D4DBBB6CB4E671528050C773021376A071EA05FBF9FB092BA300BFC6208AD4616
Malicious:	false
Preview:	2024/09/06-10:47:05.474 17a0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/09/06-10:47:05.495 17a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlTwll:Ls3Tw/
MD5:	9C7315A6D341DCA3EAD3EC3E6DAB0E82
SHA1:	66BF81C41D8BF050C836B90C7186B82CFF16F2EA
SHA-256:	755512D30A8CC34E5C3E6D1F355B7B73C0B294C4A86438B82C931EA9494A0B38
SHA-512:	4AD10F4870965537F26E7FD04EC6A8F1A7C21B2375044540A64EAB45DE3AFDEF57333B515D032B4902E0D4841BD009BB952FEF8619625BF73FEB4A1705394574
Malicious:	false
Preview:	........................................e...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlbJol/ll:Ls3e/
MD5:	FDA998E3A4A4AA630504811FAE003DE1
SHA1:	E0230284BBA6C940FF666AF378C1BEA09938086F
SHA-256:	ED27B68B7E67123BC8DC1C298536B4D73FDF8F23C8E0292D2D353D72D29081C5
SHA-512:	0C42DD6E3A5F29ECBC470A4C2D881C11DFB561B33E29C6D066E9EA3672D46CACE539FB17A3F4EF36CC03522BBEC98AA1A901712295C0B3E051D36B301AD57CBF
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.542426056804702
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcXD+0CHWZaTnU8UXyik5JdXBuBuwBSDaGNhFPjXX1/QQRCYh:YuBqDPaf5DX7ZaTnHEsgBzBSDXVLFYB0
MD5:	ABA90B5CD6C647ECB367BBDE92FA4BCA
SHA1:	C41F5B4B8C08D5D5AAA15EB300A45D8AF60B71B1
SHA-256:	97AE1862516557B8C3F5F5B44588FDFE04DEAFBE3996D2D13F5C0E5FA66F3229
SHA-512:	C5CA86622E398543A13667C11B7335E2656C62274D80D5159A824542760ACD3D4356AB8858CF4333BA380706FE88680B357B787F07CFFC1288C5C95EB507340A
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13370107624329916","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725634024"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF29c17.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.542426056804702
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcXD+0CHWZaTnU8UXyik5JdXBuBuwBSDaGNhFPjXX1/QQRCYh:YuBqDPaf5DX7ZaTnHEsgBzBSDXVLFYB0
MD5:	ABA90B5CD6C647ECB367BBDE92FA4BCA
SHA1:	C41F5B4B8C08D5D5AAA15EB300A45D8AF60B71B1
SHA-256:	97AE1862516557B8C3F5F5B44588FDFE04DEAFBE3996D2D13F5C0E5FA66F3229
SHA-512:	C5CA86622E398543A13667C11B7335E2656C62274D80D5159A824542760ACD3D4356AB8858CF4333BA380706FE88680B357B787F07CFFC1288C5C95EB507340A
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13370107624329916","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725634024"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF29e0b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.542426056804702
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcXD+0CHWZaTnU8UXyik5JdXBuBuwBSDaGNhFPjXX1/QQRCYh:YuBqDPaf5DX7ZaTnHEsgBzBSDXVLFYB0
MD5:	ABA90B5CD6C647ECB367BBDE92FA4BCA
SHA1:	C41F5B4B8C08D5D5AAA15EB300A45D8AF60B71B1
SHA-256:	97AE1862516557B8C3F5F5B44588FDFE04DEAFBE3996D2D13F5C0E5FA66F3229
SHA-512:	C5CA86622E398543A13667C11B7335E2656C62274D80D5159A824542760ACD3D4356AB8858CF4333BA380706FE88680B357B787F07CFFC1288C5C95EB507340A
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13370107624329916","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725634024"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF29e2a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.542426056804702
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcXD+0CHWZaTnU8UXyik5JdXBuBuwBSDaGNhFPjXX1/QQRCYh:YuBqDPaf5DX7ZaTnHEsgBzBSDXVLFYB0
MD5:	ABA90B5CD6C647ECB367BBDE92FA4BCA
SHA1:	C41F5B4B8C08D5D5AAA15EB300A45D8AF60B71B1
SHA-256:	97AE1862516557B8C3F5F5B44588FDFE04DEAFBE3996D2D13F5C0E5FA66F3229
SHA-512:	C5CA86622E398543A13667C11B7335E2656C62274D80D5159A824542760ACD3D4356AB8858CF4333BA380706FE88680B357B787F07CFFC1288C5C95EB507340A
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13370107624329916","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725634024"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2c54a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.542426056804702
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcXD+0CHWZaTnU8UXyik5JdXBuBuwBSDaGNhFPjXX1/QQRCYh:YuBqDPaf5DX7ZaTnHEsgBzBSDXVLFYB0
MD5:	ABA90B5CD6C647ECB367BBDE92FA4BCA
SHA1:	C41F5B4B8C08D5D5AAA15EB300A45D8AF60B71B1
SHA-256:	97AE1862516557B8C3F5F5B44588FDFE04DEAFBE3996D2D13F5C0E5FA66F3229
SHA-512:	C5CA86622E398543A13667C11B7335E2656C62274D80D5159A824542760ACD3D4356AB8858CF4333BA380706FE88680B357B787F07CFFC1288C5C95EB507340A
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13370107624329916","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725634024"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF30a52.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.542426056804702
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcXD+0CHWZaTnU8UXyik5JdXBuBuwBSDaGNhFPjXX1/QQRCYh:YuBqDPaf5DX7ZaTnHEsgBzBSDXVLFYB0
MD5:	ABA90B5CD6C647ECB367BBDE92FA4BCA
SHA1:	C41F5B4B8C08D5D5AAA15EB300A45D8AF60B71B1
SHA-256:	97AE1862516557B8C3F5F5B44588FDFE04DEAFBE3996D2D13F5C0E5FA66F3229
SHA-512:	C5CA86622E398543A13667C11B7335E2656C62274D80D5159A824542760ACD3D4356AB8858CF4333BA380706FE88680B357B787F07CFFC1288C5C95EB507340A
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13370107624329916","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725634024"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF35c79.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.542426056804702
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcXD+0CHWZaTnU8UXyik5JdXBuBuwBSDaGNhFPjXX1/QQRCYh:YuBqDPaf5DX7ZaTnHEsgBzBSDXVLFYB0
MD5:	ABA90B5CD6C647ECB367BBDE92FA4BCA
SHA1:	C41F5B4B8C08D5D5AAA15EB300A45D8AF60B71B1
SHA-256:	97AE1862516557B8C3F5F5B44588FDFE04DEAFBE3996D2D13F5C0E5FA66F3229
SHA-512:	C5CA86622E398543A13667C11B7335E2656C62274D80D5159A824542760ACD3D4356AB8858CF4333BA380706FE88680B357B787F07CFFC1288C5C95EB507340A
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13370107624329916","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725634024"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3880d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.542426056804702
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcXD+0CHWZaTnU8UXyik5JdXBuBuwBSDaGNhFPjXX1/QQRCYh:YuBqDPaf5DX7ZaTnHEsgBzBSDXVLFYB0
MD5:	ABA90B5CD6C647ECB367BBDE92FA4BCA
SHA1:	C41F5B4B8C08D5D5AAA15EB300A45D8AF60B71B1
SHA-256:	97AE1862516557B8C3F5F5B44588FDFE04DEAFBE3996D2D13F5C0E5FA66F3229
SHA-512:	C5CA86622E398543A13667C11B7335E2656C62274D80D5159A824542760ACD3D4356AB8858CF4333BA380706FE88680B357B787F07CFFC1288C5C95EB507340A
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13370107624329916","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725634024"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3af2d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.542426056804702
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcXD+0CHWZaTnU8UXyik5JdXBuBuwBSDaGNhFPjXX1/QQRCYh:YuBqDPaf5DX7ZaTnHEsgBzBSDXVLFYB0
MD5:	ABA90B5CD6C647ECB367BBDE92FA4BCA
SHA1:	C41F5B4B8C08D5D5AAA15EB300A45D8AF60B71B1
SHA-256:	97AE1862516557B8C3F5F5B44588FDFE04DEAFBE3996D2D13F5C0E5FA66F3229
SHA-512:	C5CA86622E398543A13667C11B7335E2656C62274D80D5159A824542760ACD3D4356AB8858CF4333BA380706FE88680B357B787F07CFFC1288C5C95EB507340A
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13370107624329916","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725634024"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF40b47.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.542426056804702
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtQcXD+0CHWZaTnU8UXyik5JdXBuBuwBSDaGNhFPjXX1/QQRCYh:YuBqDPaf5DX7ZaTnHEsgBzBSDXVLFYB0
MD5:	ABA90B5CD6C647ECB367BBDE92FA4BCA
SHA1:	C41F5B4B8C08D5D5AAA15EB300A45D8AF60B71B1
SHA-256:	97AE1862516557B8C3F5F5B44588FDFE04DEAFBE3996D2D13F5C0E5FA66F3229
SHA-512:	C5CA86622E398543A13667C11B7335E2656C62274D80D5159A824542760ACD3D4356AB8858CF4333BA380706FE88680B357B787F07CFFC1288C5C95EB507340A
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGiLI1S5CEVCEiltKFo40VEjcGd+qEhAvC/Q3ybsrWHgAAAAAOgAAAAAIAACAAAADaAb3d73PgaFgM/4xNhJRFSxz+Sg4/USDaw/tt/Qtp8TAAAACGY1xwZA5qor+u79B2D2lXIyc7E7APdBm6csko2awkuw5FKt3XpLnKDgUVfVRvj/9AAAAAScIgcudUSmA8BWyHWY3GJ2Ooh96gq3isIO8ufbkOR3ToLhhIgcSVGU809UvyqP/+/6Xn/gxyv/qkXkbRXKcXAQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13370107624329916","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725634024"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlslll:Ls3sl/
MD5:	E8197C48E188E4116A0AA84892AE3640
SHA1:	6D5BBE76CAADEA5591AE678004807066E092B47F
SHA-256:	EEE44AD66168AFFE0C093FABCD8330C241E0F3453E74CAB2D5BD22D512B80E92
SHA-512:	CE2C9B088FFFBADF3366F59D0DB92A933FFBEBA7EB21FACE46C26E0EE88FB8F1F31599DF4D559E5C1212C137B54A485E8B4DE853F41DDC4C6DF81597A1CF6B15
Malicious:	false
Preview:	........................................7{..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\c8d27899-e238-4e2a-8040-627852f133f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24338
Entropy (8bit):	6.052736832520059
Encrypted:	false
SSDEEP:	384:XtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NG65v019qdpVE8fu1f5Eny4vRv+kWUCGo:9MGQ7FCYXGIgtDAWtJ4n4h01zPN5Eny7
MD5:	FDB1E4F02163BE1B6193FE23956980B8
SHA1:	FF8B90ACCE10837D17F43F0C0D3719F132ACA378
SHA-256:	935C5A133D329476C381F2411495AD6F5C1D20BC960D500E4C6C884DFF7AE2F0
SHA-512:	DBA09FCBDB05E15E85FA4409377FC4E546F84F478D2FD9FF05B4DC3236B2185F0D2E4FDBDEFDA4FE95FF9DAC38A476B16DAC44636CE12C9360A2842A340ABB98
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370107625860857","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\e6c8c505-2281-436c-a669-9617a746f171.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21002
Entropy (8bit):	6.063452578166314
Encrypted:	false
SSDEEP:	384:XtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS6sv0jEQ0XvRv+kWUCGo:9MGQ7FCYXGIgtDAWtJ4nm40jEQHFB
MD5:	BC13C0FF20325407679A7376E5A69358
SHA1:	DADB6B0C2EEF7C2013B6C78938F33F53A47B6DFB
SHA-256:	C5758A1ABCFDC8884943A8E9E3862C5DAE1CFF5B2B56B3AFD713A0AC882F102C
SHA-512:	4041AD23AB9037A71CA9356F326A35003CD02CD1BAF56ADED18F342BF34BAFE49D901753DE2CC7D0BC0AB5870D9EB603D9886957DF5A61298D2DEE9DAB1746C5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370107625860857","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\063da7df-164e-4be6-b077-99df499ab7c6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.829607664521473
Encrypted:	false
SSDEEP:	192:fsNwRX1eiRUvl1tQ5r1jkQZ96qRAq1k8SPxVLZ7VTiB:fsNwZVuj+5JgQZ96q3QxVNZTiB
MD5:	0ADC44FBF9EE2993E8B6FA8AB27A83F9
SHA1:	23C8DFCBAB9674CA182340DF266C11F9CB3A437C
SHA-256:	383B05F25246579711B0B0AF3D2F3774902FAFAE833D097DEEF11EF23A0CF920
SHA-512:	8153A7262ADA1430DB03DB7D65112DCB18B89FBD3B5F8709FBAF067917C6759098F5D2EA3F387E644A7D26BD18004F71F21587333A612720E1F1D25C4792892D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0d2c8353-9012-4487-9dc1-9dd003ec78a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24722
Entropy (8bit):	6.053347253564117
Encrypted:	false
SSDEEP:	768:WMGQ7FCYXGIgtDAWtJ4nM+sEz1Fy7S3xXN8:WMGQ5XMBGiEz147MXN8
MD5:	741DA1B5DF9484142B719BF7436C5557
SHA1:	5E5B42711C39BBC3266B80DB14417DEC08D98BF0
SHA-256:	DB4961521382390D4F58A6E6D108ADC298A5CDC485FAD48A25B89379798597D8
SHA-512:	5444777E86D286901937BFA0532530C557D8744E2791E49DCEF8854BB9D3F4B4C7BF3DA454B711E23C64292828C123E4464BA4778F54D460999B19F49B6F7FE9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370107643909652","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\33ee1560-a5bb-4d10-85fa-db555df6a4e3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.8295501247939585
Encrypted:	false
SSDEEP:	192:fsNwRX1eiRUvl1tQ55j5kQZ96qRAq1k8SPxVLZ7VTiB:fsNwZVuj+5NKQZ96q3QxVNZTiB
MD5:	92E0954D011D96E173F8F04748DA0823
SHA1:	E05B11A4D70C14D700FF757F33224D6FBDF4D084
SHA-256:	A990C23BDC2685C461E8AE9B07C642E67EC98F7BA68FA225858184FEE527463C
SHA-512:	23A33D0B03E5809B478DD31FB58EEE952701C36BE203EB88E6DFE1F5D9D3C2321CF792C9954C5214700F09DF14B0EF1DC12BADC82B94ECFBCEEB4F4394A4926E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\553a32c9-97d2-42de-9258-4c1c13d0ca8e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.800203531324463
Encrypted:	false
SSDEEP:	192:fsNARX1eiRUEcQhkQU6qRAq1k8SPxVLZ7VTiQ:fsNAZVfRSQU6q3QxVNZTiQ
MD5:	99A0DE13F5BDB37D9E92D58F4F849ED1
SHA1:	71027553F75D7F4529F009DEB1E3ADA62813F932
SHA-256:	220282B7BB7B13FF147161C49E5631987D024C41B2B59CD61E9E5F314E5DBC78
SHA-512:	85AA233FBC6F419975C2A86CE9DCEAACEC400A460B44E69E59331106BDC33AD9E63C253A686D3C8CFD82DA4599AA71993547C4D90EC6A79022FD24F6E4F3440C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5a2cfa20-03d0-45cb-96db-c5471cac6397.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59920
Entropy (8bit):	6.081484034676254
Encrypted:	false
SSDEEP:	1536:WMGQ5XMBGIaf8dP0S1JtF4BHH7Z+twTmvEz14eMXN8:WMrJM8pkdP0StFYHV8w6vEztMXN8
MD5:	13D8CFDBB5FE6401D8B972BF677F9215
SHA1:	75FBB4EB514DEFC6498EECE13E15833C0C5D6108
SHA-256:	1C09BFBC3AE43C5273F7B9C64E9E7DFDC12F8622DBE72E37258079EF1C460216
SHA-512:	2066EC24816EF85070ED1471196429A7E8724AD3E3A7E3C96751F078EE1A7AC2DB078D950DF2A96973DF68BB509F95281D334B6647584C15A29ACA9E98ABFDB6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370107643909652","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5a852115-adf7-4827-a346-541a39eceb93.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.058721135071604
Encrypted:	false
SSDEEP:	384:CtMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwKOoVSQJSDTx5JkjrKyqOF:WMGQ7FCYXGIgtDAWtJ4neVSQJS3xXN8
MD5:	B66802471FDC0F4016CB0BDEA0812F14
SHA1:	40FEE354EE1A2C904786FD43D91DD88B7236ABD4
SHA-256:	65750D0CDBECA0A213018078A50C9E7CFC3A1BAE436B9706CA9419CC917D2445
SHA-512:	6E24466A7CE4DEC0863B17AE71226EE8D946662C720181D06AF87968199DEC23ECA4EB8A06D43CCF3A36813124C821988DC3E88BD0A280BAAFEA5FF4A24D6B86
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370107643909652","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5dd6a50b-6a88-4f8c-8c2c-df1bfa8f65f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.8295501247939585
Encrypted:	false
SSDEEP:	192:fsNwRX1eiRUvl1tQ55j5kQZ96qRAq1k8SPxVLZ7VTiB:fsNwZVuj+5NKQZ96q3QxVNZTiB
MD5:	92E0954D011D96E173F8F04748DA0823
SHA1:	E05B11A4D70C14D700FF757F33224D6FBDF4D084
SHA-256:	A990C23BDC2685C461E8AE9B07C642E67EC98F7BA68FA225858184FEE527463C
SHA-512:	23A33D0B03E5809B478DD31FB58EEE952701C36BE203EB88E6DFE1F5D9D3C2321CF792C9954C5214700F09DF14B0EF1DC12BADC82B94ECFBCEEB4F4394A4926E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\632fe16d-0c13-4014-ad31-03eff70f6afc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.794073081687414
Encrypted:	false
SSDEEP:	192:fsNwRX1eiRUvxQWkQU6qRAq1k8SPxVLZ7VTiB:fsNwZVuOlQU6q3QxVNZTiB
MD5:	6082FAC5E0F04608A57E086505106307
SHA1:	8E7FD3718EFB0B1F8554BEBF75F6029448E87D1C
SHA-256:	8DE5B62C37D2158BC6EE33BD60F42A7C0789B456D8336704138A4EF2713591D2
SHA-512:	C2C09F474FEA8EC71047B8096D6AB6ADFF228895F8B83516C47BBBB90DAB34855758200F7E9F96CDD1ED8A5192C59373B823B161FC7A5DF50BFCECB40AE2E3F8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6681747a-13cc-457a-ab6b-f9d62941df03.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9448
Entropy (8bit):	5.831132789752614
Encrypted:	false
SSDEEP:	192:fsNwRX1eiRUvl1tQ5ayzlkQOC96qRAq1k8SPxVLZ7VTiB:fsNwZVuj+5hz2QOC96q3QxVNZTiB
MD5:	0B23AE51E39C70C4FE3AE6A1703D0D5B
SHA1:	258DEC087C07171C8BFB3375AFBA75F81051C761
SHA-256:	6727FA86332182A0B1428BA9B1C69BE76865C95CFEF0CEB78C60DFE89A875065
SHA-512:	B0D9AB38A2003E4D11984230327A999B935BD180947F1DD493174E1E8B9684209EFC68F69538B765F00AF49164CABC0EA4D3B60284A596044392B438CE613DB1
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7969b786-d9c7-4385-811f-cb9bc6be1515.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9448
Entropy (8bit):	5.831132789752614
Encrypted:	false
SSDEEP:	192:fsNwRX1eiRUvl1tQ5ayzlkQOC96qRAq1k8SPxVLZ7VTiB:fsNwZVuj+5hz2QOC96q3QxVNZTiB
MD5:	0B23AE51E39C70C4FE3AE6A1703D0D5B
SHA1:	258DEC087C07171C8BFB3375AFBA75F81051C761
SHA-256:	6727FA86332182A0B1428BA9B1C69BE76865C95CFEF0CEB78C60DFE89A875065
SHA-512:	B0D9AB38A2003E4D11984230327A999B935BD180947F1DD493174E1E8B9684209EFC68F69538B765F00AF49164CABC0EA4D3B60284A596044392B438CE613DB1
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8a7e8a32-6279-4637-9063-2515986cb4d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59959
Entropy (8bit):	6.0814732076282825
Encrypted:	false
SSDEEP:	1536:WMGQ5XMBGxaf8dP0S1JtF4BHH7Z+twTmvEz14eMXN8:WMrJM88kdP0StFYHV8w6vEztMXN8
MD5:	BFCC7B7D907012EB232AE18F4FCBF544
SHA1:	9E3D3751399A90FD972930401BBB2DF8E1768D17
SHA-256:	E2B601E0CE1B633F4053D18C6B6DF2B73CC5FB4C18FFB68CD9C0F69F6FF8A7E2
SHA-512:	4A2E6BB34076AE1340CC3A8D252691AC37EC0CB5F352BC2CEDD2235B541AE1953A565FCDC9E235C5B0FE22AF07971336936AB1B0BFA5D4530625FB2280D51320
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370107643909652","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\1a472bfa-4f8a-41bb-9448-f7e893a92c55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66DB15FA-22FC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3116496456347251
Encrypted:	false
SSDEEP:	3072:nGgdFPYLIHLq+M+nA4aBMelN2ZMk24u8GvaxKgCZ5rDNGSJdExfq9ZDfWvVJZdMq:bqhMMGu8GCEMZdHaHWHa
MD5:	CFC7C4EF59522570A1C33EEE25360377
SHA1:	21120C40616675021E8BE318266C91E3E9EC52FE
SHA-256:	58EA1511140025E67CE23E60E6D1DEC2FA3940A6E9D5268BA77DB1BEF6E1C50B
SHA-512:	56C08299483A98EBDFF15E1CA66244C5205028ADF819E7E542D81EC5D6052E845965FEE0EA2F236A8B27A0EA25F771F357F5516C6BB82BC58A7686CD8DA28DF8
Malicious:	false
Preview:	...@..@...@.....C.].....@...............(D...C..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".usspsy20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66DB1603-1F00.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0397001772389894
Encrypted:	false
SSDEEP:	192:Or0EbtmqvDtKX7WJEa3XxxTVwg7XtiV0DA5DhAVN/K+O1gQt1zr7q01n8y08TcmQ:q0EtBeQtsnhUHagOz3X108T2RGOD
MD5:	AC5097CE3F76106F4DC776058B9DF05D
SHA1:	4BFFC82B6ED284ED0EAFB733B608F93B654AAE8C
SHA-256:	16EC9834B329A947D9024A70234E0FB7A38158224C5086326C641EF211B467B8
SHA-512:	E0021C71A86B066B18325B9B444451F0E87290AEAC4A88F0B4B80983E16404236F4E40E4D3D2FCFC5E26BAF84F0689C075DD89F13B7C1C14F2E35011F9B8EF1C
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".usspsy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66DB160A-1B5C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03920162217607097
Encrypted:	false
SSDEEP:	192:A70EbtmqvDHKX7rJu3BhESXBtghwwhTlNEH1BpI1gQMfc43XqYn8y08Tcm2RGOdB:A0EtmtX7h5cjggbc0n08T2RGOD
MD5:	8917FE2B800C14ECAA411D27333C2D76
SHA1:	7B70A13649A6ECBB6E16EEA22CE79A21B3B59790
SHA-256:	D545BBC927C6F02B0561743FC0660DEA9471040B9E1AD6FBF967EA49D596CE48
SHA-512:	EC4A184A3A5DF68E304F927B6E4538F98961AFA75C5953BA9B5E664D14A027B1953B76CB75B74206864C97DBB37A82184F1D0EAE0D4483007877AE74F7817E21
Malicious:	false
Preview:	...@..@...@.....C.].....@................^...N..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".usspsy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66DB1617-110C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0387711325233518
Encrypted:	false
SSDEEP:	192:vg0EbtmqvD3KX7eTJEa3Xxx7UpXxgg6zfhj1NEx7GtxE1gQMrjwqpqln8y08TcmQ:I0EtdTeZVQh52WmgHEqS08T2RGOD
MD5:	9B239454F11DFB51AFF5F7A51258978A
SHA1:	7C11E702A32240313ADC0B23B57570DAC23A1F73
SHA-256:	92F9D1AFEDFA8967865EAC43DA23874A7AB4D014E6868576B5D08600F22346B8
SHA-512:	0533733DB834BEFE4793D47C087992A2AFB01D3C64A6B576E148B96B758CC099AB1A95118379253841048C80F81DDE7765D8EC603F0641E0801621720B024DC9
Malicious:	false
Preview:	...@..@...@.....C.].....@................\..PL..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".usspsy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\174f0e6f-579f-43ea-95fc-0adbde0b56b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\313a909c-c6dc-4c0f-bdc7-f2fe46c6c392.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.565892809691439
Encrypted:	false
SSDEEP:	768:SVMII+7pLGLv2vWP5hfNB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAvt7E7MrwjpCtl:SVMII+cv2vWP5hfNBu1jalvt47lstl
MD5:	04F02932A9EB0586FC27FB6022E62971
SHA1:	9B86B49409612A8F99F1E471F279B8A61820C497
SHA-256:	460CA17EC492C24E14F09FF34E1822E53B41CD8237169731D3DBD4CD14C05296
SHA-512:	9B150DA9F0FB379000ACA4689C94DEF0E1D6F7928DB3D9DE22D7CD5CCFC7778DFB7AEE147245D1BFF0AE6D7A1F62FCA10FAFA1C95523BE44451E696E62603330
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370107643643241","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370107643643241","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\33c68b0f-da38-4448-b44e-96ce1eab0e90.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557962651135443
Encrypted:	false
SSDEEP:	768:SVMII+7pLGLv2vWP5hfuB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu7E7MrwspCtuy:SVMII+cv2vWP5hfuBu1jaf47ldtR
MD5:	CC4107B1E9ACFB80E6B7521C19E9CC3C
SHA1:	9FBD645D8BC4F3CCBEB94C8D4EDEF4FBDC4FD125
SHA-256:	129421971F9C5CA2DDDBC8A9B78F2A28FD82C3CC5A3DC62A3C14802564628005
SHA-512:	9F7D004F7472F9F14F05B316E79137D87BF835B8D324318E9EB65F5FDC8B11147A067512CFE27EB6D0AF46AB7BBFEF19A3155463138E5A4F13F9AD54FD5721EC
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370107643643241","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370107643643241","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\365eb205-c996-4cea-a2fc-baba5a0a499e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9223
Entropy (8bit):	5.184658402374668
Encrypted:	false
SSDEEP:	96:sVIqlPJ1Xb98TodXtJA3ddGo3YksY5Th6Cp9/x+6M8muecmAeCYe4zvrE+2X6gEf:sVIUJCod8NzYksYPpj+FVA6E+FBf
MD5:	84F57A315390C97BE40600B88BD6279C
SHA1:	C16D5AC3C7954FB7907517A652E91C00AA1A7F08
SHA-256:	46D0AAFF2CE1A0FD50F82DD72EB276F477FBB05E9A87166C604DCE5E8D536180
SHA-512:	6584FAF0674FE7622BFB799E1D735AF55AD63CA85DC4EC1541E0BFA82D2413D5E0B5C1800E0C4A4216C1A65F9EECF5773DA8F7A613BA24E3C47B574ADC353C0A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370107643936867","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\75cf5c54-4df6-425f-9fc1-24f474f0a304.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.069881814478714
Encrypted:	false
SSDEEP:	96:sVIqlPJ1Xb98TodXtJApYksY5Th6Cp9/x+6M8muecmAeCMe4zvrE+2X6gE5AtEHb:sVIUJCod8pYksYPpj+FVAuE+FBf
MD5:	DFCB9CE1CBA70FAAC5FF139C133293C6
SHA1:	F702227CF273E95B1DB4296C0D6EC30AF821414B
SHA-256:	A94D132D6ED0D066789385720E08CADE1F2EC93DF046EB16576D0B75902A346B
SHA-512:	0773289473DC5D1A1A47CAF4F330A3B70188C17DB3DF1468AA334D986BE0751A72720B36018C4D6F2C1A3DCF9085891869625725FD464483DADFDC175DC4EF29
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370107643936867","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8dee3b00-2e89-423a-8c43-645251507a04.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9295
Entropy (8bit):	5.184496950151746
Encrypted:	false
SSDEEP:	96:sVIqlPJ1Xb98TodXtJA3ddGo3YksY5Th6Cp9/x+6M8muecmAeC9Ke4zvrE+2X6gM:sVIUJCod8NzYksYPpj+FVAeE+FBf
MD5:	3FAF066A43C949EB70582558FDF874FF
SHA1:	A6ED1F4A2C4A722A7778FA836B10DF3CE60B4213
SHA-256:	CD835A58DF32DC5EA53E5487F3762AEE4E8A25A09CD36FB25888AAAC7CCA49FC
SHA-512:	6C045FB28954A6A8AF1F9FDD7A90788CAF112D3C25585B918CB9252573791B6B2146B5A7AF4772A161E29C3AF91F3C97183D8B5E7E4968345056AECCDA757DBE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370107643936867","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.320686223135625
Encrypted:	false
SSDEEP:	192:HAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:gOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	D7D660D290E9E114FF1A0ECF59E4ECCF
SHA1:	4532A1010657523683A220B77A04E6327691DB36
SHA-256:	E623321CD40B3C94F61DFCA2C0794A90B684127C69D2F92C34807C0079D7708D
SHA-512:	61BD17F9626B8AD12A71D3E6BEE59FE46FB625D24AAA974186BD2FCCE92F8654D021D60DD9A7627C2982402559CE0F1AA584F5EF3BA4C26B0E73A66AB0E92012
Malicious:	false
Preview:	...m.................DB_VERSION.1N....................QUERY_TIMESTAMP:arbitration_priority_list4...13370107646514630.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.130700388064058
Encrypted:	false
SSDEEP:	6:PaBJEj0q1wkn23oH+Tcwt9Eh1ZB2KLllaEZq2Pwkn23oH+Tcwt9Eh1tIFUv:PaBJEj01fYeb9Eh1ZFLnaCvYfYeb9Ehp
MD5:	C8B4E78F0743ED76637F40F32C927118
SHA1:	974068C892A8F7567701844227B3A280ACB82310
SHA-256:	C39E6C05CD4AD77A7F5642B463806C89C16DB587AB98E14C36B24570AAFCCCA4
SHA-512:	375CEE34E91F08146B33E2433B95F22BACA3A90053EC90390FCE59F1C8828539F966D161E06C8EF503E20C949AF5F7E0F92949A02F1273C62A3498C5781D22CC
Malicious:	false
Preview:	2024/09/06-10:47:25.246 18d0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/09/06-10:47:25.830 18d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlym7+tl:Ls3ymq
MD5:	EDC5BCE3F3042CBAB3ACF579704632A2
SHA1:	1A6F525039936CD3A9DBF58A6F1A81CEDF512108
SHA-256:	97EB68E4B1A7C383EB082248F1D0D8AFFF6DDCEB9B0D17497A7B94AD44A28786
SHA-512:	1D6197C1EDAACFE728B5350D4E467BE9F8BC9C86290969B419F342175B82BD1F95917D44122328F5C0AAF67B05B20FE2A65064B192220009096FCB9BB733C5A4
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.234426895768334
Encrypted:	false
SSDEEP:	6:PgsD1wkn23oH+TcwtnG2tbB2KLll9y+q2Pwkn23oH+TcwtnG2tMsIFUv:PLyfYebn9VFLn9DvYfYebn9GFUv
MD5:	08A49DA86E880EB2AEC075C4A402FABB
SHA1:	ABFF66333FEE3E623F1CC7789D7735A1432B15F9
SHA-256:	9A13A83452F9B9F6290B98696B6AD38B265DA7572EF9DA3FB54394ED57019833
SHA-512:	328E0BBD3A9558F58C678A9C1CB6F2FE5D5728EE6A36F794AC9068FBED301FFDF1A6B94BECA12B17653C5C79451C7F0E9FC2519075A857F4E6C97218329FE815
Malicious:	false
Preview:	2024/09/06-10:47:23.749 23b8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/09/06-10:47:24.110 23b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.192003359079453
Encrypted:	false
SSDEEP:	6:PgJ91wkn23oH+Tcwt8aVdg2KLllgdCPN+q2Pwkn23oH+Tcwt8aPrqIFUv:PqAfYeb0LnYSN+vYfYebL3FUv
MD5:	69560DA498067B704E617D058C503339
SHA1:	645545732EF2CD9EF78F00B908495637620356A8
SHA-256:	BB265AD2AA6671ADFBEFAD542A5BF29D860BD86CFD7B764CE0749F82472406C6
SHA-512:	8964E33DA8E78AC6DD56FFFE02E4EA69AE923F09E4FAE3B3DE9F4EF0F22181BB124DC1D237CE1085C5F6EC8C986EFDEB78752B583B8997EA9A15F13FBD9904C2
Malicious:	false
Preview:	2024/09/06-10:47:23.789 207c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/09/06-10:47:23.852 207c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.173633034303699
Encrypted:	false
SSDEEP:	6:Pgdk1wkn23oH+Tcwt86FB2KLllgdJVPN+q2Pwkn23oH+Tcwt865IFUv:PYTfYeb/FFLnYx+vYfYeb/WFUv
MD5:	36B5BECE4D6A3E150A85B6001C1D3A12
SHA1:	FC03152F1968B64EB7D0F5F5BDEF2349583A7FB2
SHA-256:	5651C15026F9D9FBC460EC32E9ACE8EE9E5231E5F56FD0A9B40C54D80AD2FCED
SHA-512:	39E5F28CB69E5B0D87C86310E42B8FB0F8A627863C5B16C043D4B6907B0BCD9DCA2F64167C84C6061E1A72017964570CDA1914CC5760E3EA195E29AEDD122804
Malicious:	false
Preview:	2024/09/06-10:47:23.869 207c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/09/06-10:47:23.897 207c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.178568726443333
Encrypted:	false
SSDEEP:	6:P9hOw3+q2Pwkn23oH+Tcwt8NIFUt829hQUZmw+29hQ0VkwOwkn23oH+Tcwt8+eLJ:P9Ic+vYfYebpFUt829h/+291V5JfYeb2
MD5:	4BAACB8587E949887DFF6F795014CAF1
SHA1:	ECEFC02A66AD925B721E110F88B88AED18BF5B42
SHA-256:	AA0B2056BA0D362C05515B76B0AEA3C9C4D2F11D11D46B0DA324884058B5BBC0
SHA-512:	542DB111C657ED841630608781B22C3D8CB27EF48B076406D53ED2FC38438EEA6122DA0B9CF9D85DB750324AC72E63EA5B469DEA220DD7081DB4CF8BF2FA90F6
Malicious:	false
Preview:	2024/09/06-10:47:24.046 23dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/06-10:47:24.053 23dc Recovering log #3.2024/09/06-10:47:24.053 23dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.178568726443333
Encrypted:	false
SSDEEP:	6:P9hOw3+q2Pwkn23oH+Tcwt8NIFUt829hQUZmw+29hQ0VkwOwkn23oH+Tcwt8+eLJ:P9Ic+vYfYebpFUt829h/+291V5JfYeb2
MD5:	4BAACB8587E949887DFF6F795014CAF1
SHA1:	ECEFC02A66AD925B721E110F88B88AED18BF5B42
SHA-256:	AA0B2056BA0D362C05515B76B0AEA3C9C4D2F11D11D46B0DA324884058B5BBC0
SHA-512:	542DB111C657ED841630608781B22C3D8CB27EF48B076406D53ED2FC38438EEA6122DA0B9CF9D85DB750324AC72E63EA5B469DEA220DD7081DB4CF8BF2FA90F6
Malicious:	false
Preview:	2024/09/06-10:47:24.046 23dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/06-10:47:24.053 23dc Recovering log #3.2024/09/06-10:47:24.053 23dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.32872990409968056
Encrypted:	false
SSDEEP:	6:CiA/J3+t76Y4QZZofU99pO0BYrKqR4EZY4QZvGc:CThHQws9Ld4xBQZGc
MD5:	8F923322651B9B776ED27226FF9419AE
SHA1:	51153D68AE543FC077D5CD3FF9C3FF61F4A47775
SHA-256:	F9DDB9E1F9566E005AD37F6E7B592A1507C7D04A6A18DAFB8632DB91EEC367E7
SHA-512:	173B52D711B7ED0AFF8AD09C6AE58E1AEC54DD79BBC5BFBB12A92B166F7ACE1551F8860129E5FB57A920BC8032C5B4F83804AAAA747EDC1095ECE5D741566091
Malicious:	false
Preview:	..............:...'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.3136073720557855
Encrypted:	false
SSDEEP:	12:P9wX4vYfYeb8rcHEZrELFUt829x9J/+29LsD5JfYeb8rcHEZrEZSJ:laKYfYeb8nZrExg88x9fLsVJfYeb8nZR
MD5:	F356F46EEFA34C1EDFA589C096210B93
SHA1:	A591A87270CC8D8017B735BEE082538953942D7F
SHA-256:	13ACCA55DA70E7410AB5517A19B7445A0F1B00BCE12A8502E271162B20DB4001
SHA-512:	36269A825EB09C4D3ACACE203150DBBFF5C73285E800CD9E1B1B919011557D3D36C733304B2D50B360B8027613B01BBC7BDB0BA5E732646E4A9BE82E238167E3
Malicious:	false
Preview:	2024/09/06-10:47:24.975 2378 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/06-10:47:24.976 2378 Recovering log #3.2024/09/06-10:47:24.977 2378 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.3136073720557855
Encrypted:	false
SSDEEP:	12:P9wX4vYfYeb8rcHEZrELFUt829x9J/+29LsD5JfYeb8rcHEZrEZSJ:laKYfYeb8nZrExg88x9fLsVJfYeb8nZR
MD5:	F356F46EEFA34C1EDFA589C096210B93
SHA1:	A591A87270CC8D8017B735BEE082538953942D7F
SHA-256:	13ACCA55DA70E7410AB5517A19B7445A0F1B00BCE12A8502E271162B20DB4001
SHA-512:	36269A825EB09C4D3ACACE203150DBBFF5C73285E800CD9E1B1B919011557D3D36C733304B2D50B360B8027613B01BBC7BDB0BA5E732646E4A9BE82E238167E3
Malicious:	false
Preview:	2024/09/06-10:47:24.975 2378 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/06-10:47:24.976 2378 Recovering log #3.2024/09/06-10:47:24.977 2378 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.173884298940464
Encrypted:	false
SSDEEP:	6:P9lSXIq2Pwkn23oH+Tcwt8a2jMGIFUt829lSR9FZZmw+29lSTnzkwOwkn23oH+Tg:P9IXIvYfYeb8EFUt829I9Z/+29ITnz52
MD5:	CCBCF3F056C1B98D4BB2B65C7283069C
SHA1:	6049103558DD4F50B45A8D9756220B41E0AA96BC
SHA-256:	921CE64BF29AD5B94F455E2B5DB54C1EBEF23730B6B7B70ED7B3A8B3BE6ADBB7
SHA-512:	53E2A6741B3D28F2C171A29840F8ABE9840A1E0B852434C9D454694B551C7AF1A4B499C5694B9BFECFA28FE6321244D03BAB5A74EA912BAB27DE2C136536AAF7
Malicious:	false
Preview:	2024/09/06-10:47:24.472 1780 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/06-10:47:24.474 1780 Recovering log #3.2024/09/06-10:47:24.476 1780 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.173884298940464
Encrypted:	false
SSDEEP:	6:P9lSXIq2Pwkn23oH+Tcwt8a2jMGIFUt829lSR9FZZmw+29lSTnzkwOwkn23oH+Tg:P9IXIvYfYeb8EFUt829I9Z/+29ITnz52
MD5:	CCBCF3F056C1B98D4BB2B65C7283069C
SHA1:	6049103558DD4F50B45A8D9756220B41E0AA96BC
SHA-256:	921CE64BF29AD5B94F455E2B5DB54C1EBEF23730B6B7B70ED7B3A8B3BE6ADBB7
SHA-512:	53E2A6741B3D28F2C171A29840F8ABE9840A1E0B852434C9D454694B551C7AF1A4B499C5694B9BFECFA28FE6321244D03BAB5A74EA912BAB27DE2C136536AAF7
Malicious:	false
Preview:	2024/09/06-10:47:24.472 1780 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/06-10:47:24.474 1780 Recovering log #3.2024/09/06-10:47:24.476 1780 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\22b4f592-10e2-43f6-a753-71f048d75cff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\31830eb1-ffe2-468f-b094-07c512e2c4cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\52b45363-a9f9-4269-a181-0b1edd0e33bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6e5b7c9a-6043-4704-b8a9-d153fb15aef2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.314444496450309
Encrypted:	false
SSDEEP:	24:YXsMyZVMdBsiZFRudFGcsHyZFGJ/dbG7nby:YXsJ8sWfcdsGgzbZ
MD5:	5A9203D6B46DE64C7EE9F7F845119162
SHA1:	21359835C96663ED956C53C8976EB7C9CF44B142
SHA-256:	32BBEC545B935ADE10DF6A3334A69440C3852ED7EE3CE900359AC16B1F047898
SHA-512:	8F9E003B019B20A9FBBFDB8604B7BF0EA945476F52577F251C367579FA4BABA3DBAA682A8A6A9F1E28AE09F991DD5AB6230C3CB1BDDA04182162400B1F279EB1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372699645719546","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372699646806998","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372699650115686","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\961164f5-b88d-40e7-aaa6-31bd82cc6e83.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF313d7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4006a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2ef19.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2fc67.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF313d7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d0ac8bf3-b7e7-472d-a234-44e776de1ea9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\dbac3643-8f75-4c3b-8bfc-61fcb27ef64f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.069881814478714
Encrypted:	false
SSDEEP:	96:sVIqlPJ1Xb98TodXtJApYksY5Th6Cp9/x+6M8muecmAeCMe4zvrE+2X6gE5AtEHb:sVIUJCod8pYksYPpj+FVAuE+FBf
MD5:	DFCB9CE1CBA70FAAC5FF139C133293C6
SHA1:	F702227CF273E95B1DB4296C0D6EC30AF821414B
SHA-256:	A94D132D6ED0D066789385720E08CADE1F2EC93DF046EB16576D0B75902A346B
SHA-512:	0773289473DC5D1A1A47CAF4F330A3B70188C17DB3DF1468AA334D986BE0751A72720B36018C4D6F2C1A3DCF9085891869625725FD464483DADFDC175DC4EF29
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370107643936867","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF367b4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.069881814478714
Encrypted:	false
SSDEEP:	96:sVIqlPJ1Xb98TodXtJApYksY5Th6Cp9/x+6M8muecmAeCMe4zvrE+2X6gE5AtEHb:sVIUJCod8pYksYPpj+FVAuE+FBf
MD5:	DFCB9CE1CBA70FAAC5FF139C133293C6
SHA1:	F702227CF273E95B1DB4296C0D6EC30AF821414B
SHA-256:	A94D132D6ED0D066789385720E08CADE1F2EC93DF046EB16576D0B75902A346B
SHA-512:	0773289473DC5D1A1A47CAF4F330A3B70188C17DB3DF1468AA334D986BE0751A72720B36018C4D6F2C1A3DCF9085891869625725FD464483DADFDC175DC4EF29
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370107643936867","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF393c5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.069881814478714
Encrypted:	false
SSDEEP:	96:sVIqlPJ1Xb98TodXtJApYksY5Th6Cp9/x+6M8muecmAeCMe4zvrE+2X6gE5AtEHb:sVIUJCod8pYksYPpj+FVAuE+FBf
MD5:	DFCB9CE1CBA70FAAC5FF139C133293C6
SHA1:	F702227CF273E95B1DB4296C0D6EC30AF821414B
SHA-256:	A94D132D6ED0D066789385720E08CADE1F2EC93DF046EB16576D0B75902A346B
SHA-512:	0773289473DC5D1A1A47CAF4F330A3B70188C17DB3DF1468AA334D986BE0751A72720B36018C4D6F2C1A3DCF9085891869625725FD464483DADFDC175DC4EF29
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370107643936867","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f81d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.069881814478714
Encrypted:	false
SSDEEP:	96:sVIqlPJ1Xb98TodXtJApYksY5Th6Cp9/x+6M8muecmAeCMe4zvrE+2X6gE5AtEHb:sVIUJCod8pYksYPpj+FVAuE+FBf
MD5:	DFCB9CE1CBA70FAAC5FF139C133293C6
SHA1:	F702227CF273E95B1DB4296C0D6EC30AF821414B
SHA-256:	A94D132D6ED0D066789385720E08CADE1F2EC93DF046EB16576D0B75902A346B
SHA-512:	0773289473DC5D1A1A47CAF4F330A3B70188C17DB3DF1468AA334D986BE0751A72720B36018C4D6F2C1A3DCF9085891869625725FD464483DADFDC175DC4EF29
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370107643936867","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557962651135443
Encrypted:	false
SSDEEP:	768:SVMII+7pLGLv2vWP5hfuB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu7E7MrwspCtuy:SVMII+cv2vWP5hfuBu1jaf47ldtR
MD5:	CC4107B1E9ACFB80E6B7521C19E9CC3C
SHA1:	9FBD645D8BC4F3CCBEB94C8D4EDEF4FBDC4FD125
SHA-256:	129421971F9C5CA2DDDBC8A9B78F2A28FD82C3CC5A3DC62A3C14802564628005
SHA-512:	9F7D004F7472F9F14F05B316E79137D87BF835B8D324318E9EB65F5FDC8B11147A067512CFE27EB6D0AF46AB7BBFEF19A3155463138E5A4F13F9AD54FD5721EC
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370107643643241","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370107643643241","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF34c4c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557962651135443
Encrypted:	false
SSDEEP:	768:SVMII+7pLGLv2vWP5hfuB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu7E7MrwspCtuy:SVMII+cv2vWP5hfuBu1jaf47ldtR
MD5:	CC4107B1E9ACFB80E6B7521C19E9CC3C
SHA1:	9FBD645D8BC4F3CCBEB94C8D4EDEF4FBDC4FD125
SHA-256:	129421971F9C5CA2DDDBC8A9B78F2A28FD82C3CC5A3DC62A3C14802564628005
SHA-512:	9F7D004F7472F9F14F05B316E79137D87BF835B8D324318E9EB65F5FDC8B11147A067512CFE27EB6D0AF46AB7BBFEF19A3155463138E5A4F13F9AD54FD5721EC
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370107643643241","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370107643643241","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.187123203274877
Encrypted:	false
SSDEEP:	6:Pyq2Pwkn23oH+TcwtrQMxIFUt82iZmw+2lkwOwkn23oH+TcwtrQMFLJ:PyvYfYebCFUt82i/+2l5JfYebtJ
MD5:	95DADF8656142CDA91633A11EA756F40
SHA1:	BB8AED35B3916948997FCC5642332A08ACC754ED
SHA-256:	37125CCB917D8D585F2B9CE3EEC4F35C6BEAEB87924996209B5D9B572849AEC9
SHA-512:	4F0ADABF016B12FF152F263F30FD26A1BB5E43608D5D6BFC5717346A550A15F9544757C3C8087E195C405622453EAB69F64ED1EB169333062189B75B3E26C637
Malicious:	false
Preview:	2024/09/06-10:47:39.691 1780 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/06-10:47:39.692 1780 Recovering log #3.2024/09/06-10:47:39.695 1780 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.187123203274877
Encrypted:	false
SSDEEP:	6:Pyq2Pwkn23oH+TcwtrQMxIFUt82iZmw+2lkwOwkn23oH+TcwtrQMFLJ:PyvYfYebCFUt82i/+2l5JfYebtJ
MD5:	95DADF8656142CDA91633A11EA756F40
SHA1:	BB8AED35B3916948997FCC5642332A08ACC754ED
SHA-256:	37125CCB917D8D585F2B9CE3EEC4F35C6BEAEB87924996209B5D9B572849AEC9
SHA-512:	4F0ADABF016B12FF152F263F30FD26A1BB5E43608D5D6BFC5717346A550A15F9544757C3C8087E195C405622453EAB69F64ED1EB169333062189B75B3E26C637
Malicious:	false
Preview:	2024/09/06-10:47:39.691 1780 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/06-10:47:39.692 1780 Recovering log #3.2024/09/06-10:47:39.695 1780 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.168504193056533
Encrypted:	false
SSDEEP:	6:PgdzAq2Pwkn23oH+Tcwt7Uh2ghZIFUt82gdCkwZZmw+2gdlkwOwkn23oH+Tcwt7w:PY0vYfYebIhHh2FUt82Yzc/+2Yl5JfYz
MD5:	44CAB750528A777CBE7CE5313644DF6D
SHA1:	4F00F7B87B6EBEF01E73B8E038389998A05BE3C0
SHA-256:	F7FF955ED0BB30D6DD5F215664452A3B19970D161B88AD332F453E4F40A6C8F5
SHA-512:	264AC55B6110A370C8368CF8856A8CDA647F6E6ADE681099DEBDC7A6F2A8AC26206D36A624E6FDC7C4415F9181571FFECAC0FDFB576150F08B349ED271425748
Malicious:	false
Preview:	2024/09/06-10:47:23.851 23e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/06-10:47:23.852 23e0 Recovering log #3.2024/09/06-10:47:23.853 23e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.168504193056533
Encrypted:	false
SSDEEP:	6:PgdzAq2Pwkn23oH+Tcwt7Uh2ghZIFUt82gdCkwZZmw+2gdlkwOwkn23oH+Tcwt7w:PY0vYfYebIhHh2FUt82Yzc/+2Yl5JfYz
MD5:	44CAB750528A777CBE7CE5313644DF6D
SHA1:	4F00F7B87B6EBEF01E73B8E038389998A05BE3C0
SHA-256:	F7FF955ED0BB30D6DD5F215664452A3B19970D161B88AD332F453E4F40A6C8F5
SHA-512:	264AC55B6110A370C8368CF8856A8CDA647F6E6ADE681099DEBDC7A6F2A8AC26206D36A624E6FDC7C4415F9181571FFECAC0FDFB576150F08B349ED271425748
Malicious:	false
Preview:	2024/09/06-10:47:23.851 23e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/06-10:47:23.852 23e0 Recovering log #3.2024/09/06-10:47:23.853 23e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulmqQl:LsZ
MD5:	E40C8F9CB42840E24ACD74651F1063DE
SHA1:	93C0A2BC69697018A33376766B1AEC747B7F02CC
SHA-256:	E09B4AB0590CA9D815D21C502AF61CC450C47A70B1674A81AF6DE3907E631534
SHA-512:	C1473AD803DA006BB93820CC0C87177363B937A4069AB402C8BE18AF8B1BA52D462319FDADC3B72C5D4A081583DFE22207303485C09F0EACFB88801418500194
Malicious:	false
Preview:	........................................MY..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlalK//l:Ls3uK1
MD5:	DE90D53960B07EF34835CCC63DD72213
SHA1:	4FABD66C31F9FC3AC94D6659C7D2F5D48DF0D927
SHA-256:	69BD9EE8CD4FE7D2B90D2E53D17DD43055DE0A3B73F3C651C5BA76B74263D739
SHA-512:	DFE291911341B6B8D056737D701D63EDD0D45C616E610F386DF54FC67FD0772E3E588259F20B96027241C30019DE53B328D2E5538DE6496AC45E8D42554B3240
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.2660528975295176
Encrypted:	false
SSDEEP:	12:P97OvYfYebvqBQFUt829CZ/+29zh5JfYebvqBvJ:l7MYfYebvZg88CPzzJfYebvk
MD5:	EA588CFFF42E045E519CB69583D876C7
SHA1:	B26E67CC6B2AC6517CD6849DC4CBE7D3FB67E928
SHA-256:	BAA9A920D93AF5D7F3413170D8EAB8DA0847E98DCA72FFC3FAA5618D814471EE
SHA-512:	0A169AE926EB37ABC4CA8FD1852BD3B920A33F6FCC090CF7A7D51C7B5A5A44CD4794ABB6CDBE4C82BF670D517C74BE3EF43553DED881ED136DB77CA97636E4D9
Malicious:	false
Preview:	2024/09/06-10:47:24.488 1780 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/06-10:47:24.490 1780 Recovering log #3.2024/09/06-10:47:24.493 1780 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.2660528975295176
Encrypted:	false
SSDEEP:	12:P97OvYfYebvqBQFUt829CZ/+29zh5JfYebvqBvJ:l7MYfYebvZg88CPzzJfYebvk
MD5:	EA588CFFF42E045E519CB69583D876C7
SHA1:	B26E67CC6B2AC6517CD6849DC4CBE7D3FB67E928
SHA-256:	BAA9A920D93AF5D7F3413170D8EAB8DA0847E98DCA72FFC3FAA5618D814471EE
SHA-512:	0A169AE926EB37ABC4CA8FD1852BD3B920A33F6FCC090CF7A7D51C7B5A5A44CD4794ABB6CDBE4C82BF670D517C74BE3EF43553DED881ED136DB77CA97636E4D9
Malicious:	false
Preview:	2024/09/06-10:47:24.488 1780 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/06-10:47:24.490 1780 Recovering log #3.2024/09/06-10:47:24.493 1780 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\706600d7-5917-455f-92e7-3b16206016b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF41171.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2fc57.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b9fdc0ae-63a0-40ae-a57c-7e7096d88623.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e7f23096-6a31-4488-a37a-228529c1a8ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ed883f3f-60b4-4629-b060-ef6245a3360d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.29668641173293
Encrypted:	false
SSDEEP:	12:PlvYfYebvqBZFUt82n/+2h5JfYebvqBaJ:RYfYebvyg8AJfYebvL
MD5:	0135F20010ECC1EC76F234EE06C97715
SHA1:	19172236356F703A9F10FB1B1F048FC802470041
SHA-256:	CBB077EAD5815160C99BFE550E96F4DDAE8283772063603E83EB19D6F579DE41
SHA-512:	31CD8DD24D622167D398EFEFF688F3003F224E277E760340024A2BD26EEDDC87CD30C5893836A6AB05AC46304D376A98D763C5071A4BD0AC98E23C03D2E127A0
Malicious:	false
Preview:	2024/09/06-10:47:39.650 1780 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/06-10:47:39.651 1780 Recovering log #3.2024/09/06-10:47:39.655 1780 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.29668641173293
Encrypted:	false
SSDEEP:	12:PlvYfYebvqBZFUt82n/+2h5JfYebvqBaJ:RYfYebvyg8AJfYebvL
MD5:	0135F20010ECC1EC76F234EE06C97715
SHA1:	19172236356F703A9F10FB1B1F048FC802470041
SHA-256:	CBB077EAD5815160C99BFE550E96F4DDAE8283772063603E83EB19D6F579DE41
SHA-512:	31CD8DD24D622167D398EFEFF688F3003F224E277E760340024A2BD26EEDDC87CD30C5893836A6AB05AC46304D376A98D763C5071A4BD0AC98E23C03D2E127A0
Malicious:	false
Preview:	2024/09/06-10:47:39.650 1780 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/06-10:47:39.651 1780 Recovering log #3.2024/09/06-10:47:39.655 1780 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.221033967722489
Encrypted:	false
SSDEEP:	6:Pgnq2Pwkn23oH+TcwtpIFUt82gvgZZmw+2gvgzkwOwkn23oH+Tcwta/WLJ:P8vYfYebmFUt82pZ/+2pz5JfYebaUJ
MD5:	96A8D81AFBC6AABFB5B146C7064ACBD1
SHA1:	E023439E4F350B69A182A750A5302E4D18381227
SHA-256:	B17DB16C6E690F9EB68F5F841D180A01A89400D8F69EBC417DD41BBA8CD537B6
SHA-512:	9CDB68D680FC1629AD25FC9848AF06F626B8B5BC823337F3A76F448B5489CD56D19A337DF62F64C782FDBED27017BE6C1C9122AC622ED923263F727E50BB9BB7
Malicious:	false
Preview:	2024/09/06-10:47:23.786 23a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/06-10:47:23.793 23a4 Recovering log #3.2024/09/06-10:47:23.793 23a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.221033967722489
Encrypted:	false
SSDEEP:	6:Pgnq2Pwkn23oH+TcwtpIFUt82gvgZZmw+2gvgzkwOwkn23oH+Tcwta/WLJ:P8vYfYebmFUt82pZ/+2pz5JfYebaUJ
MD5:	96A8D81AFBC6AABFB5B146C7064ACBD1
SHA1:	E023439E4F350B69A182A750A5302E4D18381227
SHA-256:	B17DB16C6E690F9EB68F5F841D180A01A89400D8F69EBC417DD41BBA8CD537B6
SHA-512:	9CDB68D680FC1629AD25FC9848AF06F626B8B5BC823337F3A76F448B5489CD56D19A337DF62F64C782FDBED27017BE6C1C9122AC622ED923263F727E50BB9BB7
Malicious:	false
Preview:	2024/09/06-10:47:23.786 23a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/06-10:47:23.793 23a4 Recovering log #3.2024/09/06-10:47:23.793 23a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:/el1lhtlNj:23B
MD5:	BA3B7E0F590E2BBC42F96FF9A1B0A801
SHA1:	DBB024F87A2F2AA413226F38E1834A54A2B9D444
SHA-256:	1C66308B2831E5512F20CEFE0D0732497A81A7E56D7316332130BE2F3ADE1745
SHA-512:	0739CF0D9FF5722C46FD08A97758C05177514E7A6737C8DE6BA107995474DBD7B12BA68FB0E42F4D0651A6767F10486BD913262C87C7A1E690045C04EB411378
Malicious:	false
Preview:	............(......W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c26e23bc-bcc2-4bb1-ba9b-bbe2dbcde709.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9333
Entropy (8bit):	5.1829957307033725
Encrypted:	false
SSDEEP:	96:sVIqlPJ1Xb98TodXtJA3ddGo3YksY5Th6Cp9/x+6M8muecmAeCRKe4zvrE+2X6gM:sVIUJCod8NzYksYPpj+FVA+E+FBf
MD5:	FEC79B8A5E1367D814CC5EA24B703C4B
SHA1:	6BEBB9E9BFF08217C368C69282230F58D0E696AE
SHA-256:	EBD54BCA09C41322138935F615844B7B680162D5179CAF67971FBA7531AAAA35
SHA-512:	77487C612550DCFD7493FD9D9295D5F4C767BCE0B9E143ED81EBCEE6E261B848FB0E7F9C7EBDBA2D7E46CB58BA0B46E28227C83F001445C46DF2F24BCF318D9F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370107643936867","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c5053a2f-718b-405d-91e6-ea245af6add4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.333168017378757
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQvxlhb/l3seGKT9rcQ6xHyYpOtl:/XntM+4lhb/l3sedhOHyEO
MD5:	3964D1205591BC3FF65088016944D9EA
SHA1:	4BCFDD916072191C96F68CFF85A8F834AB6C6BB4
SHA-256:	0A3180BB9EFB9AB9FA455D69EF74A1516EF14CD719CD9DB975D6579F0031561A
SHA-512:	D184878E6E6654CD4CA2CF4B4B9FF25790D373D81B58FCA7036139C61133943F5C730C9988B255806040B3CCA8F27E0715447639969D5F8E19E0E71B735F08B5
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f...............R...0................39_config..........6.....n ...1u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.220670772659045
Encrypted:	false
SSDEEP:	6:P9hWwM1wkn23oH+Tcwtfrl2KLll9hSQoq2Pwkn23oH+TcwtfrK+IFUv:P9AwrfYeb1Ln9ErvYfYeb23FUv
MD5:	454D3475B78293070B0D16F73293D7CC
SHA1:	CABCA53EA19AABF865017F09407077B86969053B
SHA-256:	2A2AE855F56CF3294B35C701BC7A9C514F6CF3E67A3D7F3B44B2FBD0F436BD5B
SHA-512:	D8136B9F797DD14662D1D9D41897ADF1E34C7D580BB2C89285060C29535837C92F3CFD4C22DA11952C5179231B66B512CA4C8ECBA3D4B109E5D65457F2D63C7D
Malicious:	false
Preview:	2024/09/06-10:47:24.036 23a4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/09/06-10:47:24.075 23a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9210339461383095
Encrypted:	false
SSDEEP:	12:G0nYUtTNVrPzl6/5/Xt21tzJ3PEWXZi+5uh/2Rdj0Q5jDa60:G0nYUtPrPJ6B/XMtzNP9i+4hORdZFDZ0
MD5:	E871C84A29F413E8699BE5ACC47D1D34
SHA1:	23D1371D0AA4F0EE296FA78006A4866AC40E2243
SHA-256:	305098D57D76412ABCFC0CEA79C7C6B06C1BAFB7B7707F4CF5C7002B5C60EC3A
SHA-512:	FEB0069091A4620575BB884C2A83ADE6776563251710E051E2B2D8668D0274B1537ADE45E812A88112AAA502D47B4DACD69E471347CC8E22AE94877352C95225
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....s/<..................19_........e.................18_......E...................37_.....`0M..................38_......Hf..................39_.......w<.................20_.........................20_..........................19_.....}....................18_......m=.................37_.....uTN..................38_.......h.................39_........I.................21_..........................9_......Gt&.................21_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.1791336071355145
Encrypted:	false
SSDEEP:	6:PgjloM1wkn23oH+Tcwtfrzs52KLll9h3Iq2Pwkn23oH+TcwtfrzAdIFUv:P9rfYebs9Ln9+vYfYeb9FUv
MD5:	6CBBADBB583F34AE3F48ABF37853888C
SHA1:	BF16FA808A9042EF8C327D3241DA1C795F6005C4
SHA-256:	D21A1401DF7E42AAB8A43DB8F5315A597546094B5D9D46BB2533165B9B0DA7F9
SHA-512:	061FD8EFFF93E9314EE0556BCE4EE29E7322E18CEE5AEA305CB70168C76930CF912FFCCB2F66C91AD9FCA256F1755C56889B0DA79D51C70F1AF0D098DD838451
Malicious:	false
Preview:	2024/09/06-10:47:23.970 23a4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/09/06-10:47:24.028 23a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlTtl:Ls3TX
MD5:	83F444EA2C216E13E24708EE6365037B
SHA1:	D0B21F20D18FE9DDDB29AD945E029BED49AD775B
SHA-256:	B4D22F025EEF477782CBAA1A51A8690B75B6BFD79D4FF5C2E280DB5FB22F15E5
SHA-512:	1ADEEF49E096A5B709E718BA4E5A02B8E86267A80C0B2C19BA9CD5151AC27F47662C43710C98F8FCD4FE93EAE924E751D5E828DB22260B05E3777E3096DC3BBC
Malicious:	false
Preview:	.........................................f..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlAZ5wl/l:Ls3AQX
MD5:	8772D173F897F09EEB312EE7185D557E
SHA1:	E6AA31ED25E02BE34CDFCCE4C956CA261EA4075E
SHA-256:	4545D1125E5792EFDFC8A9CB88F753C4865A79C9C79557191917EBAD890F5454
SHA-512:	9EF78020199B3F9D05BF69AD2983B9407104DEB1E77E8293F23B102BD3B774498AED4BB865BB1288F1735BAC323510DE5F44BD9395F4D4403F08C9C5B88E3541
Malicious:	false
Preview:	........................................U ..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e7b6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e7d5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30476.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30485.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF304b4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF304c4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3226d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3227d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35574.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35584.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3cfc4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3f6d4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF447b4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2031185
Entropy (8bit):	4.001541395341077
Encrypted:	false
SSDEEP:	49152:4gPY2N/MR+DgVFIlq6hhN7XtVrgKk+lClVSa4YsxeUOolPHRayAH09bnwBXQ0a/G:O
MD5:	A04D0615BD0510EF6A7A7C8E9CCF6388
SHA1:	2A0A7A4E2F6FD50A17B5A7F9DB1CD549919C66FF
SHA-256:	6C486966C18131CC0C16A9E36580D5365429640FE88A046317BA15AA128D34AD
SHA-512:	AD381404337D66221169CFFEA5A98890B86284ABC8448B62D68FCDEFAFD855C5C376838FE8D16EAD96A02D85113BF5555C80F2AA833FCC9A162E56A628E54A2F
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2031185
Entropy (8bit):	4.001541395341077
Encrypted:	false
SSDEEP:	49152:4gPY2N/MR+DgVFIlq6hhN7XtVrgKk+lClVSa4YsxeUOolPHRayAH09bnwBXQ0a/G:O
MD5:	A04D0615BD0510EF6A7A7C8E9CCF6388
SHA1:	2A0A7A4E2F6FD50A17B5A7F9DB1CD549919C66FF
SHA-256:	6C486966C18131CC0C16A9E36580D5365429640FE88A046317BA15AA128D34AD
SHA-512:	AD381404337D66221169CFFEA5A98890B86284ABC8448B62D68FCDEFAFD855C5C376838FE8D16EAD96A02D85113BF5555C80F2AA833FCC9A162E56A628E54A2F
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlplK//l:Ls3+1
MD5:	3DD01D45E8C681F8B151CE71475741E2
SHA1:	69A0F827D53953355547BDB7B98EC6D33FEF652B
SHA-256:	688DD2A0B817F7AB9F35272525CE064CFF5F758170AE105BDDEAEA5880EA3E0D
SHA-512:	9ED22A27B121E117E8BD4D1A80078B2CA75133E5F99E669A110F70F1049C33220D938E4C6E879B43B46119EFB788AD5D3A7B6C747C7D1AA81F6C74CF4DBB463B
Malicious:	false
Preview:	.........................................B..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\baf1ece6-e840-497d-800f-4169e1a7553f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.79394190812525
Encrypted:	false
SSDEEP:	192:fsNwRX1eiRUvcQhkQU6qRAq1k8SPxVLZ7VTiQ:fsNwZVuRSQU6q3QxVNZTiQ
MD5:	5410EB79264C292A3FD3E03AEC5B8D17
SHA1:	D0541F6EEC632D51FCDAA9ECD799AC13D4FE869A
SHA-256:	B9407E04B1E4A7F2B62850D9E176D385A43A19AF7B44B21D0DD650AC6473F632
SHA-512:	FC3C9AA9FEFEB1A9DB71A4B34F0723BD3E2F221AB357FD49E3ED47BCF736390F015C151B6A988C454F6DFF3FC1D540237F2C9938B79229F148042B7D3D25608B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cf526956-bb2e-4534-9980-f04fc25c1550.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7879834784791
Encrypted:	false
SSDEEP:	96:iaqkHf5ikA5ih/cI9URLl8RotogMFVvlwhIe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akRXNeiRUnho6qRAq1k8SPxVLZ7VTiq
MD5:	562B288668A4312651DB6765D8CB7DA5
SHA1:	5B6F25AA48A937F2A86926DBF06077D5B001221F
SHA-256:	FE766028748CB394DAFC9D6DA937DCC85A91D712F1460A04A1EF34E82869D1E2
SHA-512:	4774ACB86150D61A451E3C5B0A57F972DCB9232F2D30310F7629598BC7281F20765EDD2193B52C550FA1A3672FDC5ECA2A91CCE5885D2C19F2DA0DE787AC645B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACoO4oDdsJiRY2McQBGYhqhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA1g8SURRHC3MwKquGYgkCIRolrsO65LHuTo/f6ngC1zAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e815e8c0-e599-403a-aeff-8e783975f6c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.829607664521473
Encrypted:	false
SSDEEP:	192:fsNwRX1eiRUvl1tQ5r1jkQZ96qRAq1k8SPxVLZ7VTiB:fsNwZVuj+5JgQZ96q3QxVNZTiB
MD5:	0ADC44FBF9EE2993E8B6FA8AB27A83F9
SHA1:	23C8DFCBAB9674CA182340DF266C11F9CB3A437C
SHA-256:	383B05F25246579711B0B0AF3D2F3774902FAFAE833D097DEEF11EF23A0CF920
SHA-512:	8153A7262ADA1430DB03DB7D65112DCB18B89FBD3B5F8709FBAF067917C6759098F5D2EA3F387E644A7D26BD18004F71F21587333A612720E1F1D25C4792892D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.841833140384765
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxFxl9Il8uFpjdX1wc0/iBAyxeTnbzd1rc:mgYTpjdD0/iB6bU
MD5:	46C3EEEAC4F752054E1C33932E50F1FE
SHA1:	40A298B8821F6F860BBEE18AD81F4CE4F2C85AC6
SHA-256:	F3704B50772F344B27CDE678DE4E97933E6AF8B592A4D6F010F330061ADC8F21
SHA-512:	65D961F7696E5D9955E1E51F10B23314F20CF1B7B68A64F54FB153FA4AA028CC31A07DC85F9633FB1D7CA9F0E8EF2ED55D7A352354374150294C8B55A85459B0
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.I./.t.B.n.Q.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.q.D.u.K.A.3.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.993534375908955
Encrypted:	false
SSDEEP:	96:cYT8r09zXEuQXU9XDwpeKQ3ElOCHaEKWuK0jf:cg9kX8zNHEECHak0L
MD5:	0481CF9802E8E3157256A2AB9F005A3A
SHA1:	3E65C0661EE8A89F557E847E9C5EB27D074D5C31
SHA-256:	91871C2E5AC335A691D50705D33C780AB238962EA6E1DFAFBFE6C146124EBF10
SHA-512:	950F1665A0AAA7D2613F8F3E689DA68B8924D296FC6A0A249D9052B9B0BCC36F3F0AB0F3CE8728C712E9CE448CBD17BFC249DDAEAF5CA84C3DC2C179456CD324
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".k.m.v.n.7.G.s.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.q.D.u.K.A.3.

C:\Users\user\AppData\Local\Temp\11ada6d6-8db1-460d-bffe-1b0928eb507e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\1651b811-af6d-40c3-9b72-d21f4f66e125.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\9b0467dd-49d0-410c-b9e2-63c6352b1535.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\c083e64f-d7fd-4e7d-9cc2-560189fd0aba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.372008214143675
Encrypted:	false
SSDEEP:	12:Y1dfDP0Dkv/bNdio/u56s/bNmuqQP0Dkv/bNyK0u56s/C:YjfDP0Mdi6u5D4QP0Mr5M
MD5:	77CBEA11A5E4EE495D943DB1F7E8AD8B
SHA1:	DEB53589B870C28E9AC5FB1F649C8E717D01CEC3
SHA-256:	BE4A9AB1605365FAAC6BD11A1B968423D5C88AF45D2C02CCE932FB630A21FDFF
SHA-512:	5B0BC9FE9DCC22E59469CAC8C74C8B4AD46172A8E9E381865968C76F077DE6BC0304FEE14F094575992EE9E5CEBFD82EFA50234E59E5428721BD7DEFB87B1914
Malicious:	false
Preview:	{"logTime": "0906/144709", "correlationVector":"50477865100F471A9847E6B1757E95AB","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0906/144727", "correlationVector":"qvgqms0BKDy2mShK5nDZjO","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0906/144727", "correlationVector":"C60BA9EB7B7B48C5B52FAB94AA0F9E35","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0906/144727", "correlationVector":"4cxfZBV2PfMfdOblFNtQNS","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\scoped_dir8956_104679905\9b0467dd-49d0-410c-b9e2-63c6352b1535.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8956_104679905\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8956_104679905\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8956_104679905\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8956_104679905\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\1651b811-af6d-40c3-9b72-d21f4f66e125.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8956_42467732\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5102294786708392
Encrypted:	false
SSDEEP:	48:8EhOdOqftMsJD/rNzBdLXuH3kDpW2AxodOqEtMsJD/rNzngdLXuH3k+21:I3uXkDNgnIuXkz
MD5:	E8B46A4A3E83227A0AB51C2475BBDEED
SHA1:	43AE801E26EBF69A722E5C890BAFF37ECE012779
SHA-256:	060EEAA6809334CE4588AA750BD4137BD81174A6526957A3BE15DA61B1C86365
SHA-512:	CDB684CA432B9191EC05069B2D3CB65C9AFA3BA2EE21D463C6C29F983256B62AD5CD669EBF4F645D8D7D57008071320B8179A27C3955964B96CEF065A99C0DE6
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...%.,.k....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWT`..PROGRA~2.........O.IDWT`....................V.....6...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWS`..MICROS~1..D......(Ux.&Y.u............................%.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.&Y.u..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.&Y.u....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............#4......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MWHO3WQJCL7ZWNILBUIH.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5075752705202454
Encrypted:	false
SSDEEP:	48:8ExodOqEtMsJD/rNzBdLXuH3kDpW2AxodOqEtMsJD/rNzngdLXuH3k+21:F3uXkDNgnIuXkz
MD5:	75668C3EF5C9CF4D5127D66E22CAEF85
SHA1:	449D19B74418E24A0456883411B837BF469B8FFD
SHA-256:	08266770A8E6CCD59E6BCB70F0612C6BC73C62C98E8174F36E8DF28A934EF466
SHA-512:	A6114FCE951D455FC19D927CB02EF9CCFD686AD3952FD025E53D564B8A622C0A04106DE4512D2157F590F2247F5F75920D62C1EDA17F4D7BBFE8A727F2A3B2CA
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...%.,.k....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....&Y.u..PROGRA~2.........O.I&Y.u....................V.....F-W.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWS`..MICROS~1..D......(Ux.&Y.u............................%.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.&Y.u...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.&Y.u..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.&Y.u....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............#4......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QWB70KS74P3UFOE0IYN1.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5102294786708392
Encrypted:	false
SSDEEP:	48:8EhOdOqftMsJD/rNzBdLXuH3kDpW2AxodOqEtMsJD/rNzngdLXuH3k+21:I3uXkDNgnIuXkz
MD5:	E8B46A4A3E83227A0AB51C2475BBDEED
SHA1:	43AE801E26EBF69A722E5C890BAFF37ECE012779
SHA-256:	060EEAA6809334CE4588AA750BD4137BD81174A6526957A3BE15DA61B1C86365
SHA-512:	CDB684CA432B9191EC05069B2D3CB65C9AFA3BA2EE21D463C6C29F983256B62AD5CD669EBF4F645D8D7D57008071320B8179A27C3955964B96CEF065A99C0DE6
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...%.,.k....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWT`..PROGRA~2.........O.IDWT`....................V.....6...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWS`..MICROS~1..D......(Ux.&Y.u............................%.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.&Y.u..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.&Y.u....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............#4......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5075752705202454
Encrypted:	false
SSDEEP:	48:8ExodOqEtMsJD/rNzBdLXuH3kDpW2AxodOqEtMsJD/rNzngdLXuH3k+21:F3uXkDNgnIuXkz
MD5:	75668C3EF5C9CF4D5127D66E22CAEF85
SHA1:	449D19B74418E24A0456883411B837BF469B8FFD
SHA-256:	08266770A8E6CCD59E6BCB70F0612C6BC73C62C98E8174F36E8DF28A934EF466
SHA-512:	A6114FCE951D455FC19D927CB02EF9CCFD686AD3952FD025E53D564B8A622C0A04106DE4512D2157F590F2247F5F75920D62C1EDA17F4D7BBFE8A727F2A3B2CA
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...%.,.k....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....&Y.u..PROGRA~2.........O.I&Y.u....................V.....F-W.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWS`..MICROS~1..D......(Ux.&Y.u............................%.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.&Y.u...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.&Y.u..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.&Y.u....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............#4......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.579708791207708
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	2f7a9833af3cdf8be25012f2204e4172
SHA1:	bbdf8ae8039be9b7873e45ebc7782564d2218c53
SHA256:	96183c18f914b3e765227bc2655f4a6e6cc65482ede2c0f09a0c62d0247a67c0
SHA512:	0c51390a8b48484c69424b72a3b0cb8dc9383dc24f29719e6b9b2d2362620bbf22a48186632a5bfef480a20d4c5b0273a0fa39eece278b01bae6fd468eab1dd5
SSDEEP:	12288:9qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacT0:9qDEvCTbMWu7rQYlBQcBiT6rprG8as0
TLSH:	96159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66DB1412 [Fri Sep 6 14:39:14 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FD1A06CD343h
jmp 00007FD1A06CCC4Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FD1A06CCE2Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FD1A06CCDFAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FD1A06CF9EDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FD1A06CFA38h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FD1A06CFA21h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	b3f142112340078268be6cdf74916e33	False	0.2869010416666667	data	5.164782826631444	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 6, 2024 16:47:08.239216089 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 6, 2024 16:47:10.251503944 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.251543045 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.251617908 CEST	49749	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.251657009 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.251663923 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.251708031 CEST	49749	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.251987934 CEST	49749	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.252008915 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.252214909 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.252229929 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.900029898 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.900445938 CEST	49749	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.900465965 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.901519060 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.901576042 CEST	49749	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.902076006 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.902257919 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.902273893 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.902724028 CEST	49749	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.902789116 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.902945042 CEST	49749	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.902956009 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.903485060 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.903542995 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.904407024 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.904467106 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.904593945 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:10.904602051 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:10.958216906 CEST	49749	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.005106926 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.006217957 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.006241083 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.006249905 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.006274939 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.006295919 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.006304026 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.006326914 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.006337881 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.006380081 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.006412029 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.014112949 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.014134884 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.014142036 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.014154911 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.014169931 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.014178038 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.014187098 CEST	49749	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.014209032 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.014225960 CEST	49749	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.014235973 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.014259100 CEST	49749	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.014298916 CEST	49749	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.015446901 CEST	49749	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.015465021 CEST	443	49749	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.100330114 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.100343943 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.100388050 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.100435972 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.100461960 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.100493908 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.100519896 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.102705002 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.102720976 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.102803946 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.102811098 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.102864027 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.187427998 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.187447071 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.187489033 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.187520981 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.187539101 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.187563896 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.187571049 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.187578917 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.187608957 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.188391924 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:11.188405037 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:11.266410112 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.266459942 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.266529083 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.266637087 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.266644001 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.266737938 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.266911030 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.266956091 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.267008066 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.267318964 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.267328024 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.267431974 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.267827034 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.267839909 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.267865896 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.267878056 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.268143892 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.268152952 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.268326044 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.268347025 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.323214054 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.323261023 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.323335886 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.324069977 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.324084997 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.730410099 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.730628014 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.730647087 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.731668949 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.731791019 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.732896090 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.732963085 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.733086109 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.733094931 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.735023022 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.735255957 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.735266924 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.735662937 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.735877991 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.735884905 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.736313105 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.736391068 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.737224102 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.737306118 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.737373114 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.737441063 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.737945080 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.737956047 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.738233089 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.738318920 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.738905907 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.738914967 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.756743908 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.756970882 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.757009029 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.758058071 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.758112907 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.759227991 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.759296894 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.759450912 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.759464025 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.786382914 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.810739040 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.811002970 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.811028957 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.812211037 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.812274933 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.813380957 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.813463926 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.813561916 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.860500097 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.860868931 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.860932112 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.861157894 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.861174107 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.863594055 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.863780022 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.863950014 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.863956928 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.864474058 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.864504099 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.868503094 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.868561029 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.868668079 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.868823051 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.868830919 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.878248930 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.878298044 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.878457069 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:11.878472090 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:11.911325932 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.955255032 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.955321074 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:11.955380917 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.955585003 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:11.955605030 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:12.321290016 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:12.321337938 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:12.321463108 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:12.323165894 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:12.323182106 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:12.829986095 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:12.830030918 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:12.830173016 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:12.830179930 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:12.830194950 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:12.830244064 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:12.830735922 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:12.830749035 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:12.830935955 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:12.830945015 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:12.990874052 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:12.990966082 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:12.994676113 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:12.994690895 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:12.994940996 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:13.037245035 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:13.080502987 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:13.269171953 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:13.269252062 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:13.269458055 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:13.295103073 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.295329094 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.295360088 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.295703888 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.296294928 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.296394110 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.296457052 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.296804905 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.296813011 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.297224998 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.297501087 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.297561884 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.314124107 CEST	49763	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.314152002 CEST	443	49763	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.314229012 CEST	49763	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.314354897 CEST	49764	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.314387083 CEST	443	49764	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.314443111 CEST	49764	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.314649105 CEST	49763	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.314663887 CEST	443	49763	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.315046072 CEST	49764	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.315064907 CEST	443	49764	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.336292982 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.339225054 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.358288050 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:13.358330011 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:13.358344078 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:13.358350992 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:13.420598984 CEST	49765	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:13.420634985 CEST	443	49765	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:13.420705080 CEST	49765	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:13.421032906 CEST	49765	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:13.421044111 CEST	443	49765	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:13.618814945 CEST	49766	443	192.168.2.4	142.251.32.100
Sep 6, 2024 16:47:13.618861914 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:13.618951082 CEST	49766	443	192.168.2.4	142.251.32.100
Sep 6, 2024 16:47:13.619344950 CEST	49766	443	192.168.2.4	142.251.32.100
Sep 6, 2024 16:47:13.619358063 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:13.779889107 CEST	443	49763	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.780155897 CEST	49763	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.780174971 CEST	443	49763	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.780591011 CEST	443	49763	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.780663967 CEST	49763	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.781311989 CEST	443	49763	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.781368017 CEST	49763	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.783864975 CEST	443	49764	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.784421921 CEST	49764	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.784452915 CEST	443	49764	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.785044909 CEST	443	49764	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.785106897 CEST	49764	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.786192894 CEST	443	49764	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.786243916 CEST	49764	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.788130999 CEST	49763	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.788212061 CEST	443	49763	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.788469076 CEST	49763	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.788477898 CEST	443	49763	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.788636923 CEST	49764	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.788777113 CEST	443	49764	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.788923025 CEST	49764	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.788944006 CEST	443	49764	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.830384016 CEST	49764	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.834131956 CEST	49763	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.895390034 CEST	443	49763	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.896821976 CEST	49763	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.896863937 CEST	443	49763	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.896918058 CEST	49763	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.898768902 CEST	443	49764	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.898940086 CEST	443	49764	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:13.898986101 CEST	49764	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.901797056 CEST	49764	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:13.901818037 CEST	443	49764	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.077714920 CEST	443	49765	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:14.077819109 CEST	49765	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:14.079359055 CEST	49765	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:14.079370975 CEST	443	49765	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:14.079766035 CEST	443	49765	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:14.080894947 CEST	49765	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:14.083381891 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:14.083801985 CEST	49766	443	192.168.2.4	142.251.32.100
Sep 6, 2024 16:47:14.083827019 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:14.084872007 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:14.084929943 CEST	49766	443	192.168.2.4	142.251.32.100
Sep 6, 2024 16:47:14.086771011 CEST	49766	443	192.168.2.4	142.251.32.100
Sep 6, 2024 16:47:14.086838961 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:14.087114096 CEST	49766	443	192.168.2.4	142.251.32.100
Sep 6, 2024 16:47:14.087121964 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:14.128509998 CEST	443	49765	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:14.131851912 CEST	49766	443	192.168.2.4	142.251.32.100
Sep 6, 2024 16:47:14.183958054 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:14.184010029 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:14.184041023 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:14.184068918 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:14.184091091 CEST	49766	443	192.168.2.4	142.251.32.100
Sep 6, 2024 16:47:14.184118986 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:14.184142113 CEST	49766	443	192.168.2.4	142.251.32.100
Sep 6, 2024 16:47:14.184189081 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:14.184237003 CEST	49766	443	192.168.2.4	142.251.32.100
Sep 6, 2024 16:47:14.185698032 CEST	49766	443	192.168.2.4	142.251.32.100
Sep 6, 2024 16:47:14.185713053 CEST	443	49766	142.251.32.100	192.168.2.4
Sep 6, 2024 16:47:14.211329937 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.211385012 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.211447954 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.211611032 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.211618900 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.211683035 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.211901903 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.211914062 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.212090969 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.212101936 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.357266903 CEST	443	49765	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:14.357333899 CEST	443	49765	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:14.357383013 CEST	49765	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:14.358043909 CEST	49765	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:14.358072042 CEST	443	49765	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:14.358088970 CEST	49765	443	192.168.2.4	184.28.90.27
Sep 6, 2024 16:47:14.358094931 CEST	443	49765	184.28.90.27	192.168.2.4
Sep 6, 2024 16:47:14.672729969 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.673958063 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.673991919 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.674384117 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.674443960 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.675108910 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.675159931 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.676767111 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.676847935 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.691018105 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.692897081 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.692923069 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.693376064 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.693448067 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.694119930 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.694179058 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.695974112 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.696069002 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.723562002 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.723592997 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.739172935 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.739201069 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.764830112 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.793971062 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:19.410769939 CEST	49672	443	192.168.2.4	173.222.162.32
Sep 6, 2024 16:47:19.410819054 CEST	443	49672	173.222.162.32	192.168.2.4
Sep 6, 2024 16:47:23.183271885 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:23.183320999 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:23.183382988 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:23.184681892 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:23.184696913 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:23.989166975 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:23.989351988 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:23.993350029 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:23.993365049 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:23.993705988 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:24.038762093 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:25.882711887 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:25.928493977 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:26.148087025 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:26.148108959 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:26.148117065 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:26.148125887 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:26.148153067 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:26.148173094 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:26.148192883 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:26.148231983 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:26.148283005 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:26.148358107 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:26.148420095 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:26.148427010 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:26.148534060 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:26.148587942 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:26.261888027 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:26.261933088 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:26.261984110 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:26.262192011 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:26.262211084 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:26.691219091 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:26.691219091 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:47:26.691246033 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:26.691257000 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 6, 2024 16:47:26.992283106 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:26.992314100 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:26.992420912 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:26.992686987 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:26.992697001 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.009265900 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.009594917 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.009614944 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.009996891 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.010013103 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.010077000 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.010087013 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.010113955 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.010135889 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.010973930 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.012455940 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.012569904 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.012617111 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.056504011 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.067672014 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.067689896 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.115760088 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.273372889 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.273411989 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.273484945 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.273516893 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.276293993 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.278851986 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.278871059 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.282445908 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.282620907 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.282634974 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.288800001 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.288949013 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.288964033 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.294991016 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.295070887 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.295085907 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.301278114 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.301963091 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.301976919 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.307629108 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.307682037 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.307701111 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.313998938 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.314060926 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.314078093 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.363692999 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.365298033 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.365365982 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.365391016 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.365530014 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.365550041 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.366853952 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.368586063 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.374890089 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.374927044 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.374937057 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.374955893 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.375041008 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.381135941 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.387614012 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.387644053 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.387682915 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.387700081 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.387881041 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.393997908 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.401097059 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.401125908 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.401180029 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.401200056 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.401457071 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.406270027 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.412363052 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.412389994 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.412435055 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.412455082 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.412851095 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.417577028 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.423161983 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.423201084 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.423209906 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.423227072 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.423445940 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.428462982 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.434113026 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.434140921 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.434180021 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.434197903 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.434233904 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.439408064 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.444999933 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.445029020 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.445065975 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.445082903 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.445348024 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.450155973 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.455851078 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.455883026 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.455921888 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.455943108 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.456068993 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.458237886 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.461720943 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.461749077 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.461802959 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.461819887 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.461932898 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.465353012 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.468909979 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.468940020 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.468955040 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.468971014 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.469271898 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.472347021 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.475730896 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.475797892 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.475816011 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.479293108 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.479342937 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.479357958 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.482881069 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.482907057 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.482933998 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.482950926 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.482986927 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.486191988 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.489778996 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.489816904 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.489836931 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.489847898 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.490112066 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.493216991 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.496629953 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.496659994 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.496678114 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.496685982 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.497087002 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.500297070 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.503683090 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.503714085 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.503735065 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.503742933 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.503782988 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.507033110 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.510593891 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.510622978 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.510807037 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.510817051 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.510859966 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.514076948 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.519078016 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.519109964 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.519165039 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.519175053 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.519520998 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.520904064 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.524707079 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.524740934 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.524789095 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.524799109 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.524840117 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.527476072 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.530466080 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.530498028 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.530524969 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.530574083 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.530585051 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.533788919 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.533963919 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.533972025 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.536792994 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.536859035 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.537420034 CEST	49777	443	192.168.2.4	142.250.186.65
Sep 6, 2024 16:47:27.537435055 CEST	443	49777	142.250.186.65	192.168.2.4
Sep 6, 2024 16:47:27.642136097 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.642466068 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:27.642481089 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.643506050 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.643568039 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:27.644727945 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:27.644788980 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.644928932 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:27.692497969 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.692574024 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:27.692589998 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.739483118 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:27.753959894 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.753983021 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.753992081 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.754023075 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.754034042 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.754049063 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.754043102 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:27.754065990 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.754095078 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:27.754101038 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:27.754111052 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:27.754154921 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:27.755307913 CEST	49781	443	192.168.2.4	13.107.246.60
Sep 6, 2024 16:47:27.755325079 CEST	443	49781	13.107.246.60	192.168.2.4
Sep 6, 2024 16:47:28.203329086 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:28.203399897 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:28.203521013 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:28.204518080 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:28.204581976 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:28.204619884 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:29.899944067 CEST	49785	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:29.899980068 CEST	443	49785	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:29.900044918 CEST	49785	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:29.900315046 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:29.900343895 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:29.900394917 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:29.900604963 CEST	49785	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:29.900618076 CEST	443	49785	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:29.900712967 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:29.900722027 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:29.939244986 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:29.939270973 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:29.939368963 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:29.940073013 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:29.940087080 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.354522943 CEST	443	49785	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:30.354794979 CEST	49785	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:30.354808092 CEST	443	49785	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:30.355377913 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.355559111 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.355565071 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.355887890 CEST	443	49785	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:30.355941057 CEST	49785	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:30.356509924 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.356573105 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.357157946 CEST	49785	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:30.357222080 CEST	443	49785	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:30.357584000 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.357642889 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.357801914 CEST	49785	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:30.357810974 CEST	443	49785	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:30.357925892 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.357932091 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.398735046 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.399002075 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.399008989 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.400394917 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.400451899 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.401515007 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.401577950 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.401706934 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.401714087 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.411396027 CEST	49785	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:30.411454916 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.442666054 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.469127893 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.469203949 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.469322920 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.469482899 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.469502926 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.493598938 CEST	443	49785	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:30.493669987 CEST	443	49785	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:30.493738890 CEST	49785	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:30.494009972 CEST	49785	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:30.494029999 CEST	443	49785	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:30.536180019 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.536240101 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:30.538898945 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.538953066 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:30.538965940 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:44.589736938 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:44.589776993 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:44.589921951 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:44.590033054 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:44.590056896 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:44.590280056 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:44.590289116 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:44.590298891 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:44.590514898 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:44.590522051 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.046044111 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.046478987 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.046497107 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.046838999 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.047281981 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.047359943 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.047470093 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.049700022 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.050244093 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.050257921 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.050865889 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.051141977 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.051245928 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.051572084 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.088501930 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.096496105 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.101897955 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.171881914 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.171966076 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.172236919 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.172410965 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.172436953 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.172755003 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.172813892 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.172895908 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.173033953 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.173044920 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.173448086 CEST	49790	443	192.168.2.4	152.195.19.97
Sep 6, 2024 16:47:45.173468113 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:45.173546076 CEST	49790	443	192.168.2.4	152.195.19.97
Sep 6, 2024 16:47:45.173691988 CEST	49790	443	192.168.2.4	152.195.19.97
Sep 6, 2024 16:47:45.173698902 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:45.722889900 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:45.723149061 CEST	49790	443	192.168.2.4	152.195.19.97
Sep 6, 2024 16:47:45.723165035 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:45.724189997 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:45.724272013 CEST	49790	443	192.168.2.4	152.195.19.97
Sep 6, 2024 16:47:45.725487947 CEST	49790	443	192.168.2.4	152.195.19.97
Sep 6, 2024 16:47:45.725548029 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:45.725982904 CEST	49790	443	192.168.2.4	152.195.19.97
Sep 6, 2024 16:47:45.726000071 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:45.770224094 CEST	49790	443	192.168.2.4	152.195.19.97
Sep 6, 2024 16:47:45.824023962 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:45.824376106 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:45.824383974 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:45.824410915 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:45.824446917 CEST	49790	443	192.168.2.4	152.195.19.97
Sep 6, 2024 16:47:45.824460030 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:45.824507952 CEST	49790	443	192.168.2.4	152.195.19.97
Sep 6, 2024 16:47:45.824520111 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:45.824615955 CEST	49790	443	192.168.2.4	152.195.19.97
Sep 6, 2024 16:47:45.825514078 CEST	49790	443	192.168.2.4	152.195.19.97
Sep 6, 2024 16:47:45.825527906 CEST	443	49790	152.195.19.97	192.168.2.4
Sep 6, 2024 16:47:46.192251921 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.192286968 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.192380905 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.192548037 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.192579031 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.192719936 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.192728996 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.192734003 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.192869902 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.192878962 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.648627996 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.649019957 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.649049997 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.649399042 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.650218964 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.650283098 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.665952921 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.666260004 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.666273117 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.666606903 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.667031050 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.667164087 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.692091942 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.707715034 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:59.724344969 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:59.724375010 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:59.739938974 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:59.739963055 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 6, 2024 16:48:01.558490992 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:01.558567047 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:01.558654070 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:01.571832895 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:01.571909904 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:01.571974039 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:03.100085020 CEST	49795	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:48:03.100126982 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:03.100212097 CEST	49795	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:48:03.100584984 CEST	49795	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:48:03.100591898 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:03.875158072 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:03.875423908 CEST	49795	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:48:03.879322052 CEST	49795	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:48:03.879333973 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:03.879641056 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:03.888320923 CEST	49795	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:48:03.928505898 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:04.207016945 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:04.207067013 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:04.207084894 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:04.207207918 CEST	49795	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:48:04.207216978 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:04.207389116 CEST	49795	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:48:04.208411932 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:04.208465099 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:04.208492041 CEST	49795	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:48:04.208498955 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:04.208518028 CEST	49795	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:48:04.208837032 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:04.210900068 CEST	49795	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:48:04.212301016 CEST	49795	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:48:04.212317944 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:04.212332964 CEST	49795	443	192.168.2.4	40.68.123.157
Sep 6, 2024 16:48:04.212340117 CEST	443	49795	40.68.123.157	192.168.2.4
Sep 6, 2024 16:48:05.937927961 CEST	49796	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:05.937982082 CEST	443	49796	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:05.938097954 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:05.938138962 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:05.938163996 CEST	49796	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:05.938194036 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:05.938365936 CEST	49796	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:05.938390017 CEST	443	49796	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:05.938492060 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:05.938507080 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.388420105 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.391674042 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.391701937 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.392046928 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.392478943 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.392556906 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.422338963 CEST	443	49796	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.422604084 CEST	49796	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.422635078 CEST	443	49796	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.423047066 CEST	443	49796	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.423319101 CEST	49796	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.423433065 CEST	443	49796	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.442874908 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.474673033 CEST	49796	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:13.209001064 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:13.209033966 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 6, 2024 16:48:13.209079027 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:13.209084988 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 6, 2024 16:48:21.299251080 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:21.299331903 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:21.299444914 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:21.324436903 CEST	443	49796	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:21.324549913 CEST	443	49796	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:21.324631929 CEST	49796	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:24.340617895 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:24.340648890 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:24.340681076 CEST	49791	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:24.340715885 CEST	443	49791	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:44.724947929 CEST	49767	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:48:44.724967957 CEST	443	49767	142.251.32.110	192.168.2.4
Sep 6, 2024 16:48:44.740252018 CEST	49768	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:48:44.740281105 CEST	443	49768	142.251.32.110	192.168.2.4
Sep 6, 2024 16:48:58.223434925 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:58.223467112 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 6, 2024 16:48:58.223496914 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:58.223501921 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:06.301723957 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:49:06.301759005 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 16:49:06.332943916 CEST	49796	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:49:06.332984924 CEST	443	49796	172.64.41.3	192.168.2.4
Sep 6, 2024 16:49:08.072046995 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.072096109 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.072169065 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.072304964 CEST	49802	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.072315931 CEST	443	49802	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.072359085 CEST	49802	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.072582960 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.072598934 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.072721958 CEST	49802	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.072734118 CEST	443	49802	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.949069023 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.949451923 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.949479103 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.949857950 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.950159073 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.950227022 CEST	443	49801	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.966669083 CEST	443	49802	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.966990948 CEST	49802	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.967024088 CEST	443	49802	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.967473030 CEST	443	49802	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.967771053 CEST	49802	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.967886925 CEST	443	49802	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:09.004787922 CEST	49801	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:09.020517111 CEST	49802	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:09.047760010 CEST	49803	443	192.168.2.4	23.200.0.9
Sep 6, 2024 16:49:09.047807932 CEST	443	49803	23.200.0.9	192.168.2.4
Sep 6, 2024 16:49:09.047910929 CEST	49803	443	192.168.2.4	23.200.0.9
Sep 6, 2024 16:49:09.048122883 CEST	49803	443	192.168.2.4	23.200.0.9
Sep 6, 2024 16:49:09.048136950 CEST	443	49803	23.200.0.9	192.168.2.4
Sep 6, 2024 16:49:09.551451921 CEST	443	49803	23.200.0.9	192.168.2.4
Sep 6, 2024 16:49:09.551882029 CEST	49803	443	192.168.2.4	23.200.0.9
Sep 6, 2024 16:49:09.551912069 CEST	443	49803	23.200.0.9	192.168.2.4
Sep 6, 2024 16:49:09.552187920 CEST	443	49803	23.200.0.9	192.168.2.4
Sep 6, 2024 16:49:09.552920103 CEST	49803	443	192.168.2.4	23.200.0.9
Sep 6, 2024 16:49:09.552972078 CEST	443	49803	23.200.0.9	192.168.2.4
Sep 6, 2024 16:49:09.553144932 CEST	49803	443	192.168.2.4	23.200.0.9
Sep 6, 2024 16:49:09.600496054 CEST	443	49803	23.200.0.9	192.168.2.4
Sep 6, 2024 16:49:09.694392920 CEST	443	49803	23.200.0.9	192.168.2.4
Sep 6, 2024 16:49:09.694466114 CEST	443	49803	23.200.0.9	192.168.2.4
Sep 6, 2024 16:49:09.694560051 CEST	49803	443	192.168.2.4	23.200.0.9
Sep 6, 2024 16:49:09.694842100 CEST	49803	443	192.168.2.4	23.200.0.9
Sep 6, 2024 16:49:09.694865942 CEST	443	49803	23.200.0.9	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 6, 2024 16:47:06.902888060 CEST	53	63375	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:08.030320883 CEST	52305	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:08.030527115 CEST	50547	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:09.307151079 CEST	53	52564	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:09.334726095 CEST	53	52391	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:11.256176949 CEST	61075	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:11.256472111 CEST	55258	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:11.256807089 CEST	51201	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:11.257097006 CEST	61357	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:11.257519007 CEST	59339	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:11.257854939 CEST	57630	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:11.258321047 CEST	51037	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:11.258471012 CEST	59076	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:11.265227079 CEST	53	61357	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:11.265264034 CEST	53	61075	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:11.265275955 CEST	53	51201	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:11.265291929 CEST	53	55258	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:11.265676975 CEST	53	57630	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:11.265925884 CEST	53	51037	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:11.266033888 CEST	53	59076	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:11.266135931 CEST	53	59339	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:11.315502882 CEST	63166	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:11.315778971 CEST	63844	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:11.322479963 CEST	53	63166	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:11.322654963 CEST	53	63844	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:12.510468006 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:12.829363108 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:12.965452909 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:12.965485096 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:12.965500116 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:12.965516090 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:12.965538025 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:12.966172934 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:12.968488932 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:12.968882084 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:12.968996048 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:12.969729900 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:12.969988108 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.068451881 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.068512917 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.068528891 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.068541050 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.068922043 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.069196939 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.070245028 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.071582079 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.071670055 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.071861029 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.168494940 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.203279018 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.209999084 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.210490942 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.311697960 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.311716080 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.311857939 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.313483000 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.516155958 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.516380072 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.616812944 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.617214918 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.617501020 CEST	443	53174	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:13.618071079 CEST	53174	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:13.898724079 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.210977077 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.341742992 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.341763973 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.342231035 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.349899054 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.349972010 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.350126028 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.350214005 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.350768089 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.351490974 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.352585077 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.352715969 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.353107929 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.353276014 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.449927092 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.449949026 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.450054884 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.450289011 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.466705084 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.467120886 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.468272924 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:14.468944073 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:14.562402010 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:22.290457010 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:22.290507078 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:22.385529041 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:22.407488108 CEST	138	138	192.168.2.4	192.168.2.255
Sep 6, 2024 16:47:22.411806107 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:22.431057930 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:22.431535006 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:22.431963921 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:22.473798037 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:22.551352978 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:26.253695965 CEST	59190	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:26.253832102 CEST	56047	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:26.261024952 CEST	53	59190	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:26.261233091 CEST	53	56047	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:29.636636972 CEST	53	54070	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:29.880939007 CEST	63575	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:29.881154060 CEST	53874	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:29.881505966 CEST	62118	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:29.881726027 CEST	59085	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:29.898693085 CEST	53	63575	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:29.898881912 CEST	53	53874	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:29.898900032 CEST	53	59085	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:29.899130106 CEST	53	62118	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:29.931391954 CEST	64263	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:29.931673050 CEST	61430	53	192.168.2.4	1.1.1.1
Sep 6, 2024 16:47:29.938478947 CEST	53	64263	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:29.938824892 CEST	53	61430	1.1.1.1	192.168.2.4
Sep 6, 2024 16:47:43.293751955 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:43.294100046 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:43.388920069 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:43.403130054 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:43.403292894 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:43.403609991 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:43.429992914 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:43.462013006 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:43.462172031 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:43.522386074 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:43.562416077 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:43.583861113 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:43.584194899 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:43.702877998 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:43.710697889 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:43.714212894 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:43.808120012 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:43.822240114 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:43.822448015 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:43.822531939 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:43.848740101 CEST	58243	443	192.168.2.4	142.251.32.110
Sep 6, 2024 16:47:43.941848993 CEST	443	58243	142.251.32.110	192.168.2.4
Sep 6, 2024 16:47:44.589320898 CEST	62560	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:44.896943092 CEST	62560	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.047457933 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.047499895 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.049134970 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.049388885 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.049407959 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.049421072 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.049593925 CEST	62560	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.051362991 CEST	62560	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.051948071 CEST	62560	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.052112103 CEST	62560	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.145848036 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.145867109 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.145875931 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.145885944 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.146646023 CEST	62560	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.147303104 CEST	62560	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:45.241373062 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:45.271033049 CEST	62560	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:46.189897060 CEST	62560	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:46.190572977 CEST	62560	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:46.191754103 CEST	51769	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.285569906 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:46.286364079 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:46.286676884 CEST	443	62560	162.159.61.3	192.168.2.4
Sep 6, 2024 16:47:46.287029982 CEST	62560	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:47:46.504796028 CEST	51769	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.647403955 CEST	443	51769	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.647413969 CEST	443	51769	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.647425890 CEST	443	51769	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.647576094 CEST	443	51769	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.647583008 CEST	443	51769	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.647933960 CEST	51769	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.649106979 CEST	51769	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.649806976 CEST	51769	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.649915934 CEST	51769	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.650698900 CEST	51769	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.650995016 CEST	51769	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.754043102 CEST	443	51769	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.754148960 CEST	443	51769	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.754153967 CEST	443	51769	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.754163980 CEST	443	51769	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.754471064 CEST	51769	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.754533052 CEST	51769	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.754960060 CEST	443	51769	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.755064011 CEST	443	51769	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.755659103 CEST	51769	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:47:46.849275112 CEST	443	51769	172.64.41.3	192.168.2.4
Sep 6, 2024 16:47:46.877964973 CEST	51769	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:05.937730074 CEST	59681	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.240210056 CEST	59681	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.382668018 CEST	443	59681	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.382688999 CEST	443	59681	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.382704973 CEST	443	59681	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.382718086 CEST	443	59681	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.382730007 CEST	443	59681	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.389563084 CEST	59681	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.391237974 CEST	59681	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.391972065 CEST	59681	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.392091990 CEST	59681	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.392699003 CEST	59681	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.392780066 CEST	59681	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.496210098 CEST	443	59681	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.496232986 CEST	443	59681	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.496252060 CEST	443	59681	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.496262074 CEST	443	59681	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.496725082 CEST	59681	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.496807098 CEST	59681	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.497741938 CEST	443	59681	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.498192072 CEST	443	59681	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.498253107 CEST	443	59681	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.498445034 CEST	59681	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:06.590419054 CEST	443	59681	172.64.41.3	192.168.2.4
Sep 6, 2024 16:48:06.629842043 CEST	59681	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:48:14.336383104 CEST	62466	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:14.336560965 CEST	62466	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:14.336899042 CEST	62466	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:14.336999893 CEST	62466	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:14.708105087 CEST	62466	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:14.783838034 CEST	443	62466	162.159.61.3	192.168.2.4
Sep 6, 2024 16:48:14.784499884 CEST	62466	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:14.802354097 CEST	443	62466	162.159.61.3	192.168.2.4
Sep 6, 2024 16:48:14.802427053 CEST	443	62466	162.159.61.3	192.168.2.4
Sep 6, 2024 16:48:14.802437067 CEST	443	62466	162.159.61.3	192.168.2.4
Sep 6, 2024 16:48:14.802444935 CEST	443	62466	162.159.61.3	192.168.2.4
Sep 6, 2024 16:48:14.802547932 CEST	62466	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:14.802618980 CEST	62466	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:14.802686930 CEST	62466	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:14.878537893 CEST	443	62466	162.159.61.3	192.168.2.4
Sep 6, 2024 16:48:14.896620035 CEST	443	62466	162.159.61.3	192.168.2.4
Sep 6, 2024 16:48:14.897018909 CEST	62466	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:14.992207050 CEST	443	62466	162.159.61.3	192.168.2.4
Sep 6, 2024 16:48:14.993550062 CEST	443	62466	162.159.61.3	192.168.2.4
Sep 6, 2024 16:48:14.993598938 CEST	443	62466	162.159.61.3	192.168.2.4
Sep 6, 2024 16:48:14.993933916 CEST	62466	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:48:14.994911909 CEST	62394	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:14.995058060 CEST	62394	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:15.331630945 CEST	62394	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:15.445605040 CEST	443	62394	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:15.449346066 CEST	443	62394	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:15.449357986 CEST	443	62394	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:15.449807882 CEST	62394	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:15.449883938 CEST	62394	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:15.450125933 CEST	62394	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:15.450136900 CEST	62394	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:15.450304985 CEST	62394	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:15.465938091 CEST	443	62394	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:15.544235945 CEST	443	62394	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:15.544823885 CEST	443	62394	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:15.544832945 CEST	443	62394	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:15.545090914 CEST	62394	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:15.545243025 CEST	443	62394	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:15.558406115 CEST	443	62394	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:15.558460951 CEST	443	62394	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:15.558675051 CEST	62394	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:15.560302973 CEST	443	62394	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:15.560580015 CEST	443	62394	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:15.560679913 CEST	62394	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:15.590944052 CEST	62394	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:15.665079117 CEST	443	62394	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:45.711344004 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:45.711503029 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:46.114398956 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:46.192787886 CEST	443	52154	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:46.192838907 CEST	443	52154	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:46.193413973 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:46.193468094 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:46.193769932 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:46.193783045 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:46.193903923 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:46.193903923 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:46.199563980 CEST	443	52154	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:46.209855080 CEST	443	52154	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:46.210117102 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:46.289577007 CEST	443	52154	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:46.289969921 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:46.290281057 CEST	443	52154	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:46.290534019 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:46.291819096 CEST	443	52154	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:46.291831017 CEST	443	52154	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:46.305039883 CEST	443	52154	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:46.306927919 CEST	443	52154	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:46.307249069 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:46.310887098 CEST	443	52154	142.250.81.238	192.168.2.4
Sep 6, 2024 16:48:46.311178923 CEST	52154	443	192.168.2.4	142.250.81.238
Sep 6, 2024 16:48:46.406035900 CEST	443	52154	142.250.81.238	192.168.2.4
Sep 6, 2024 16:49:03.650130033 CEST	58163	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:49:03.650229931 CEST	58163	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:49:03.650482893 CEST	58163	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:49:03.650576115 CEST	58163	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:49:04.053375006 CEST	58163	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:49:04.240444899 CEST	443	58163	172.64.41.3	192.168.2.4
Sep 6, 2024 16:49:04.240905046 CEST	443	58163	172.64.41.3	192.168.2.4
Sep 6, 2024 16:49:04.240978003 CEST	443	58163	172.64.41.3	192.168.2.4
Sep 6, 2024 16:49:04.240988970 CEST	443	58163	172.64.41.3	192.168.2.4
Sep 6, 2024 16:49:04.240998030 CEST	443	58163	172.64.41.3	192.168.2.4
Sep 6, 2024 16:49:04.241415024 CEST	58163	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:49:04.241465092 CEST	58163	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:49:04.241530895 CEST	58163	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:49:04.241578102 CEST	58163	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:49:04.336544037 CEST	443	58163	172.64.41.3	192.168.2.4
Sep 6, 2024 16:49:04.337032080 CEST	58163	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:49:04.446424007 CEST	443	58163	172.64.41.3	192.168.2.4
Sep 6, 2024 16:49:04.447294950 CEST	443	58163	172.64.41.3	192.168.2.4
Sep 6, 2024 16:49:04.447869062 CEST	443	58163	172.64.41.3	192.168.2.4
Sep 6, 2024 16:49:04.448168039 CEST	58163	443	192.168.2.4	172.64.41.3
Sep 6, 2024 16:49:08.071746111 CEST	57942	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.380611897 CEST	57942	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.938972950 CEST	443	57942	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.939323902 CEST	443	57942	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.939335108 CEST	443	57942	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.939347029 CEST	443	57942	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.939357996 CEST	443	57942	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:08.939888000 CEST	57942	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.941999912 CEST	57942	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.942114115 CEST	57942	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:08.949598074 CEST	57942	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:09.036638021 CEST	443	57942	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:09.036662102 CEST	443	57942	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:09.036670923 CEST	443	57942	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:09.036674976 CEST	443	57942	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:09.037314892 CEST	57942	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:09.037377119 CEST	57942	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:09.045375109 CEST	443	57942	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:09.046582937 CEST	443	57942	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:09.047009945 CEST	443	57942	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:09.047256947 CEST	57942	443	192.168.2.4	162.159.61.3
Sep 6, 2024 16:49:09.135133028 CEST	443	57942	162.159.61.3	192.168.2.4
Sep 6, 2024 16:49:09.161385059 CEST	57942	443	192.168.2.4	162.159.61.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 6, 2024 16:47:08.030320883 CEST	192.168.2.4	1.1.1.1	0x2293	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:08.030527115 CEST	192.168.2.4	1.1.1.1	0x2c29	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Sep 6, 2024 16:47:11.256176949 CEST	192.168.2.4	1.1.1.1	0xf1a4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.256472111 CEST	192.168.2.4	1.1.1.1	0xa31e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 16:47:11.256807089 CEST	192.168.2.4	1.1.1.1	0x761	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.257097006 CEST	192.168.2.4	1.1.1.1	0x4966	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 16:47:11.257519007 CEST	192.168.2.4	1.1.1.1	0xb7c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.257854939 CEST	192.168.2.4	1.1.1.1	0xcd6a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 16:47:11.258321047 CEST	192.168.2.4	1.1.1.1	0xc50d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.258471012 CEST	192.168.2.4	1.1.1.1	0xcee0	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 16:47:11.315502882 CEST	192.168.2.4	1.1.1.1	0x9185	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.315778971 CEST	192.168.2.4	1.1.1.1	0x90dd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 16:47:26.253695965 CEST	192.168.2.4	1.1.1.1	0xc55	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:26.253832102 CEST	192.168.2.4	1.1.1.1	0xc2a6	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Sep 6, 2024 16:47:29.880939007 CEST	192.168.2.4	1.1.1.1	0x5b07	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:29.881154060 CEST	192.168.2.4	1.1.1.1	0x7cb5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 16:47:29.881505966 CEST	192.168.2.4	1.1.1.1	0x356a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:29.881726027 CEST	192.168.2.4	1.1.1.1	0xe8cf	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 16:47:29.931391954 CEST	192.168.2.4	1.1.1.1	0xff9f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:29.931673050 CEST	192.168.2.4	1.1.1.1	0x4168	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 6, 2024 16:47:08.038027048 CEST	1.1.1.1	192.168.2.4	0x2c29	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:08.038583040 CEST	1.1.1.1	192.168.2.4	0x2293	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:10.251060009 CEST	1.1.1.1	192.168.2.4	0x504d	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:10.251060009 CEST	1.1.1.1	192.168.2.4	0x504d	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.265227079 CEST	1.1.1.1	192.168.2.4	0x4966	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 16:47:11.265264034 CEST	1.1.1.1	192.168.2.4	0xf1a4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.265264034 CEST	1.1.1.1	192.168.2.4	0xf1a4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.265275955 CEST	1.1.1.1	192.168.2.4	0x761	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.265275955 CEST	1.1.1.1	192.168.2.4	0x761	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.265291929 CEST	1.1.1.1	192.168.2.4	0xa31e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 16:47:11.265676975 CEST	1.1.1.1	192.168.2.4	0xcd6a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 16:47:11.265925884 CEST	1.1.1.1	192.168.2.4	0xc50d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.265925884 CEST	1.1.1.1	192.168.2.4	0xc50d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.266033888 CEST	1.1.1.1	192.168.2.4	0xcee0	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 16:47:11.266135931 CEST	1.1.1.1	192.168.2.4	0xb7c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.266135931 CEST	1.1.1.1	192.168.2.4	0xb7c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.322479963 CEST	1.1.1.1	192.168.2.4	0x9185	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.322479963 CEST	1.1.1.1	192.168.2.4	0x9185	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:11.322654963 CEST	1.1.1.1	192.168.2.4	0x90dd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 16:47:26.261024952 CEST	1.1.1.1	192.168.2.4	0xc55	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:26.261024952 CEST	1.1.1.1	192.168.2.4	0xc55	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.65	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:26.261233091 CEST	1.1.1.1	192.168.2.4	0xc2a6	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:26.991482019 CEST	1.1.1.1	192.168.2.4	0x7e40	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:26.991482019 CEST	1.1.1.1	192.168.2.4	0x7e40	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:27.558407068 CEST	1.1.1.1	192.168.2.4	0xff59	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:27.559185982 CEST	1.1.1.1	192.168.2.4	0x8cae	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:27.559185982 CEST	1.1.1.1	192.168.2.4	0x8cae	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:28.576968908 CEST	1.1.1.1	192.168.2.4	0x9237	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:28.576968908 CEST	1.1.1.1	192.168.2.4	0x9237	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:28.577028990 CEST	1.1.1.1	192.168.2.4	0x36b2	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:29.898693085 CEST	1.1.1.1	192.168.2.4	0x5b07	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:29.898693085 CEST	1.1.1.1	192.168.2.4	0x5b07	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:29.898881912 CEST	1.1.1.1	192.168.2.4	0x7cb5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 16:47:29.898900032 CEST	1.1.1.1	192.168.2.4	0xe8cf	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 16:47:29.899130106 CEST	1.1.1.1	192.168.2.4	0x356a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:29.899130106 CEST	1.1.1.1	192.168.2.4	0x356a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:29.938478947 CEST	1.1.1.1	192.168.2.4	0xff9f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:29.938478947 CEST	1.1.1.1	192.168.2.4	0xff9f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:29.938824892 CEST	1.1.1.1	192.168.2.4	0x4168	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 16:47:30.607223988 CEST	1.1.1.1	192.168.2.4	0x7d9e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:30.607223988 CEST	1.1.1.1	192.168.2.4	0x7d9e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:31.623898983 CEST	1.1.1.1	192.168.2.4	0x7d9e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:31.623898983 CEST	1.1.1.1	192.168.2.4	0x7d9e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:32.623238087 CEST	1.1.1.1	192.168.2.4	0x7d9e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:32.623238087 CEST	1.1.1.1	192.168.2.4	0x7d9e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:34.637320995 CEST	1.1.1.1	192.168.2.4	0x7d9e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:34.637320995 CEST	1.1.1.1	192.168.2.4	0x7d9e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 6, 2024 16:47:38.637716055 CEST	1.1.1.1	192.168.2.4	0x7d9e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 16:47:38.637716055 CEST	1.1.1.1	192.168.2.4	0x7d9e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
2024-09-06 14:47:45 UTC	162.159.61.3	192.168.2.4	0x0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	true
2024-09-06 14:47:45 UTC	162.159.61.3	192.168.2.4	0x0	No error (0)	sni1gl.wpc.nucdn.net		152.195.19.97	A (IP address)	IN (0x0001)	true
2024-09-06 14:47:45 UTC	162.159.61.3	192.168.2.4	0x0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	true

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

slscr.update.microsoft.com

clients2.googleusercontent.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49749	13.107.246.60	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:10 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 14:47:11 UTC	559	IN	HTTP/1.1 200 OK Date: Fri, 06 Sep 2024 14:47:10 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Wed, 04 Sep 2024 17:17:44 GMT ETag: 0x8DCCD057D8088C1 x-ms-request-id: f7ce689d-701e-002c-4072-ffea3a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240906T144710Z-16579567576txfkctmnqv2e9c40000000ds000000000bws6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-09-06 14:47:11 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49748	13.107.246.60	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:10 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 14:47:11 UTC	562	IN	HTTP/1.1 200 OK Date: Fri, 06 Sep 2024 14:47:10 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: ed2d6e16-301e-006f-0748-ffc0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240906T144710Z-16579567576gnfmq2acf56mm700000000du000000000t3wt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-06 14:47:11 UTC	15822	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-09-06 14:47:11 UTC	16384	IN	Data Raw: 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 Data Ascii: 0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-09-06 14:47:11 UTC	16384	IN	Data Raw: 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-09-06 14:47:11 UTC	16384	IN	Data Raw: d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 Data Ascii: .7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-09-06 14:47:11 UTC	5233	IN	Data Raw: 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 Data Ascii: yVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49758	172.64.41.3	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:11 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 14:47:11 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 14:47:11 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 14:47:11 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bef40bad9f17c8a-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 14:47:11 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 17 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49755	172.64.41.3	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:11 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 14:47:11 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 14:47:11 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 14:47:11 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bef40badefe19db-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 14:47:11 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 15 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49756	162.159.61.3	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:11 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 14:47:11 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 14:47:11 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 14:47:11 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bef40badd261839-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 14:47:11 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e9 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49757	162.159.61.3	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:11 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 14:47:11 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 14:47:11 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 14:47:11 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bef40baebb5430f-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 14:47:11 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 02 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49759	172.64.41.3	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:11 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 14:47:11 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 14:47:11 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 14:47:11 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bef40bb6a158c2f-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 14:47:11 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 17 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49760	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:13 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-06 14:47:13 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=25964 Date: Fri, 06 Sep 2024 14:47:13 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49763	142.251.32.110	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:13 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-06 14:47:13 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 06 Sep 2024 14:47:13 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49764	142.251.32.110	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:13 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-06 14:47:13 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 06 Sep 2024 14:47:13 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49765	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:14 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-06 14:47:14 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=25935 Date: Fri, 06 Sep 2024 14:47:14 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-06 14:47:14 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49766	142.251.32.100	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:14 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-06 14:47:14 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 06 Sep 2024 14:36:59 GMT Expires: Sat, 14 Sep 2024 14:36:59 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 615 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-06 14:47:14 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-09-06 14:47:14 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-09-06 14:47:14 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-09-06 14:47:14 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-09-06 14:47:14 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49769	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:25 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ESVUozsBaVxxmsv&MD=dBosmPUx HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-06 14:47:26 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 88878219-2e18-4ebb-936b-d2d8e846f26c MS-RequestId: 2152af27-d711-4bc9-828c-3434dd68daf1 MS-CV: PALlYCTNzU6r6Azy.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Sep 2024 14:47:25 GMT Connection: close Content-Length: 24490
2024-09-06 14:47:26 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-06 14:47:26 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49777	142.250.186.65	443	9204	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:27 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 14:47:27 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AD-8ljup6TbM7RFBvWc-kCA6OtI7NZOxTGFRr6nRdwjxXDCAgXFN40yyl5B0vtujwUOtH-PxPdv_mwDTvg X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Thu, 05 Sep 2024 19:15:10 GMT Expires: Fri, 05 Sep 2025 19:15:10 GMT Cache-Control: public, max-age=31536000 Age: 70337 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-06 14:47:27 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-09-06 14:47:27 UTC	1390	IN	Data Raw: fd c7 0f 59 dd ca cf cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d Data Ascii: Y0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>
2024-09-06 14:47:27 UTC	1390	IN	Data Raw: b0 78 c3 9a 50 64 5d fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad Data Ascii: xPd]DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewW
2024-09-06 14:47:27 UTC	1390	IN	Data Raw: d9 73 4a e4 91 70 9d a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d Data Ascii: sJp:fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~
2024-09-06 14:47:27 UTC	1390	IN	Data Raw: 58 f0 77 67 86 f4 73 f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb Data Ascii: Xwgs9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:
2024-09-06 14:47:27 UTC	1390	IN	Data Raw: 4d 15 00 a4 81 86 68 ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a Data Ascii: Mh3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:
2024-09-06 14:47:27 UTC	1390	IN	Data Raw: a0 8e 2c ba 65 e8 66 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 Data Ascii: ,ef4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$
2024-09-06 14:47:27 UTC	1390	IN	Data Raw: 3f ec fa 62 d7 ae 70 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 Data Ascii: ?bpnh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u
2024-09-06 14:47:27 UTC	1390	IN	Data Raw: f9 d6 22 50 e1 7c 45 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 Data Ascii: "P\|E'3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9
2024-09-06 14:47:27 UTC	1390	IN	Data Raw: 4e 57 c1 ef e1 60 9a 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f Data Ascii: NW`^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gOD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49781	13.107.246.60	443	9204	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:27 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 14:47:27 UTC	531	IN	HTTP/1.1 200 OK Date: Fri, 06 Sep 2024 14:47:27 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Wed, 04 Sep 2024 17:17:44 GMT ETag: 0x8DCCD057D8088C1 x-ms-request-id: f7ce689d-701e-002c-4072-ffea3a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240906T144727Z-16579567576xfl5xzh7yws029s0000000dz000000000nf35 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-06 14:47:27 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49785	172.64.41.3	443	9204	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 14:47:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 14:47:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 14:47:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bef412f4dfb430e-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 14:47:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 03 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49786	162.159.61.3	443	9204	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 14:47:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 14:47:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 14:47:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bef412f29cd8ce3-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 14:47:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&Q)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49787	162.159.61.3	443	9204	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 14:47:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 14:47:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 14:47:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bef412f8c460cbd-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 14:47:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49788	162.159.61.3	443	9204	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 14:47:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 2f 00 0c 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA)/+
2024-09-06 14:47:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 14:47:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bef418b0d44c359-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 14:47:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 06 00 01 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d 96 00 34 04 73 74 61 72 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 08 64 65 6c 69 76 65 72 79 c0 33 c0 52 00 05 00 01 00 01 51 06 00 26 11 63 64 70 2d 66 2d 73 73 6c 2d 74 6c 75 2d 6e 65 74 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 92 00 05 00 01 00 00 00 b2 00 1c 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 09 61 7a 75 72 65 65 64 67 65 c0 b3 c0 c4 00 05 00 01 00 00 06 8e 00 15 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 02 65 63 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA4starsftludldeliverympmicrosoftcomdelivery3RQ&cdp-f-ssl-tlu-nettrafficmanagernetwildcardtlu-sslazureedgewildcardtlu-sslec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49789	162.159.61.3	443	9204	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 14:47:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 2f 00 0c 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcom)/+
2024-09-06 14:47:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 14:47:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bef418b0f5e433e-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 14:47:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 07 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0c 18 00 34 04 73 74 61 72 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 08 64 65 6c 69 76 65 72 79 c0 33 c0 52 00 05 00 01 00 01 4f 88 00 26 11 63 64 70 2d 66 2d 73 73 6c 2d 74 6c 75 2d 6e 65 74 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 92 00 05 00 01 00 00 00 ae 00 1c 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 09 61 7a 75 72 65 65 64 67 65 c0 b3 c0 c4 00 05 00 01 00 00 06 8a 00 15 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 02 65 63 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcom4starsftludldeliverympmicrosoftcomdelivery3RO&cdp-f-ssl-tlu-nettrafficmanagernetwildcardtlu-sslazureedgewildcardtlu-sslec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49790	152.195.19.97	443	9204	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:47:45 UTC	624	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726238847&P2=404&P3=2&P4=ZJiiOvRBe%2b9%2bJI%2fXcAO1dUUrGMzPd1brAt%2bvxklo0Lhr5dVkZk%2f7r2%2fXerJxncA1hnM6aAJfTxbPG9d3jE5gAQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: 4cxfZBV2PfMfdOblFNtQNS Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 14:47:45 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5560596 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Fri, 06 Sep 2024 14:47:45 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-09-06 14:47:45 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49795	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:48:03 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ESVUozsBaVxxmsv&MD=dBosmPUx HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-06 14:48:04 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: ebd8a190-c4ef-43f3-916b-1bb1682cfde4 MS-RequestId: 28fe5992-2d4d-4b87-aa41-3b2fb15d70ca MS-CV: ahcQOT5xdU2AdrJL.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Sep 2024 14:48:03 GMT Connection: close Content-Length: 30005
2024-09-06 14:48:04 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-06 14:48:04 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49803	23.200.0.9	443	7240	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 14:49:09 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 14:49:09 UTC	331	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 Date: Fri, 06 Sep 2024 14:49:09 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.09ac2d17.1725634149.8f101e5 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Target ID:	0
Start time:	10:47:03
Start date:	06/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd80000
File size:	917'504 bytes
MD5 hash:	2F7A9833AF3CDF8BE25012F2204E4172
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	10:47:04
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:47:04
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2136,i,4423155273628034527,7311035686177159598,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:47:04
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	10:47:05
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:47:08
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7476 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:47:08
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7504 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:47:09
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6dee00000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:47:09
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=2008,i,15374091502074587826,8101910181350904482,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6dee00000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:47:22
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:47:23
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	10:47:24
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4180 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:47:26
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:8
Imagebase:	0x7ff6dee00000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:47:26
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=2108,i,14258337925381642518,11596338112421160654,262144 /prefetch:8
Imagebase:	0x7ff6dee00000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:47:30
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:47:31
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2156,i,742917363766338702,15304000816538498523,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:47:38
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:47:38
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1868,i,12810158684501883132,4649790317243992434,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:47:51
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:47:52
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=2108,i,1297920287701116190,17240021859614814705,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.7%
Total number of Nodes:	1396
Total number of Limit Nodes:	49

Executed Functions

Function 00D9F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
keyboardthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00D9F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00DDF474
IsIconic.USER32(00000000), ref: 00DDF47D
ShowWindow.USER32(00000000,00000009), ref: 00DDF48A
SetForegroundWindow.USER32(00000000), ref: 00DDF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00DDF4AA
GetCurrentThreadId.KERNEL32 ref: 00DDF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00DDF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00DDF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00DDF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00DDF4DE
SetForegroundWindow.USER32(00000000), ref: 00DDF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DDF4F6
keybd_event.USER32(00000012,00000000), ref: 00DDF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DDF50B
keybd_event.USER32(00000012,00000000), ref: 00DDF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DDF519
keybd_event.USER32(00000012,00000000), ref: 00DDF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DDF528
keybd_event.USER32(00000012,00000000), ref: 00DDF52D
SetForegroundWindow.USER32(00000000), ref: 00DDF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00DDF557

Strings

Shell_TrayWnd, xrefs: 00DDF46F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 1027e761a7550086b734b908764b84966633480c2bd4ef5f0332c97838e9215b
Instruction ID: 9ff3617d43bd02521aa69d076343ee21e845fcbd2a87bb32deb606568c63ca0f
Opcode Fuzzy Hash: 1027e761a7550086b734b908764b84966633480c2bd4ef5f0332c97838e9215b
Instruction Fuzzy Hash: 00313271A80218BFEB216FB69C49FBF7E6DEB44B50F244066F601F61D1C6B19900AA61

Function 00D842DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00D8430D

Part of subcall function 00D86B57: _wcslen.LIBCMT ref: 00D86B6A

GetCurrentProcess.KERNEL32(?,00E1CB64,00000000,?,?), ref: 00D84422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00D84429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00D84454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00D84466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00D84474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00D8447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00D844A0

Strings

|O, xrefs: 00DC36F8
GetNativeSystemInfo, xrefs: 00D84460
kernel32.dll, xrefs: 00D8444F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 07fd7def72f213a1544cf1bfefe13ecce1fc3cb16f9fe5d384b937c5dd56a354
Instruction ID: 4a1de09354618546f0d78702d6e7650de3a37b9ca26bf3d0c179185479d73ca5
Opcode Fuzzy Hash: 07fd7def72f213a1544cf1bfefe13ecce1fc3cb16f9fe5d384b937c5dd56a354
Instruction Fuzzy Hash: 8CA1AE6290A3C1DFC719DB6FBC617957FA46F26346B1A8CEDD181B3A62D260490CCB31

Function 00D842A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00D850AA,?,?,00000000,00000000), ref: 00D842B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00D850AA,?,?,00000000,00000000), ref: 00D842C9
LoadResource.KERNEL32(?,00000000,?,?,00D850AA,?,?,00000000,00000000,?,?,?,?,?,?,00D84F20), ref: 00DC35BE
SizeofResource.KERNEL32(?,00000000,?,?,00D850AA,?,?,00000000,00000000,?,?,?,?,?,?,00D84F20), ref: 00DC35D3
LockResource.KERNEL32(00D850AA,?,?,00D850AA,?,?,00000000,00000000,?,?,?,?,?,?,00D84F20,?), ref: 00DC35E6

Strings

SCRIPT, xrefs: 00D842BF

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: e13a000c5961b21b38c0431cb01fb333b0d911c52cd74f0b8ad5d4dcfaf12147
Instruction ID: d5eb27734fd0a7d9ed028fc55ceb6a8924322a116b522a027fe26b8c9b5af793
Opcode Fuzzy Hash: e13a000c5961b21b38c0431cb01fb333b0d911c52cd74f0b8ad5d4dcfaf12147
Instruction Fuzzy Hash: 2911AC70241705BFD7219F66DC48F677BB9EBC9B55F248169B402E6260DB71D804C630

Function 00DC2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00D82B6B

Part of subcall function 00D83A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00E51418,?,00D82E7F,?,?,?,00000000), ref: 00D83A78

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00E42224), ref: 00DC2C10
ShellExecuteW.SHELL32(00000000,?,?,00E42224), ref: 00DC2C17

Strings

runas, xrefs: 00DC2C0B

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 5cf2d498e101cabc33a2aa1e098d3ef2a51b7d24c85e93072573f58217e4a780
Instruction ID: 21486edf5e2a8baa4456f6e1fd44e3afdf225a896fd61b7751800a54b565696b
Opcode Fuzzy Hash: 5cf2d498e101cabc33a2aa1e098d3ef2a51b7d24c85e93072573f58217e4a780
Instruction Fuzzy Hash: C311D3312083016EC704FF64E852EBEB7A4DBD5751F48282DF196630A2CF219A4E8732

Function 00DEDBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00DC5222), ref: 00DEDBCE
GetFileAttributesW.KERNELBASE(?), ref: 00DEDBDD
FindFirstFileW.KERNEL32(?,?), ref: 00DEDBEE
FindClose.KERNEL32(00000000), ref: 00DEDBFA

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: fae2bf396ff4973766078831a5fcf6cf98dae71c6ef7238812347b41a091c1f9
Instruction ID: b66e9db1eba32b6913f2abe91122ee17d4a4e99abdb40581e2a6ac9defd01b91
Opcode Fuzzy Hash: fae2bf396ff4973766078831a5fcf6cf98dae71c6ef7238812347b41a091c1f9
Instruction Fuzzy Hash: DFF0A0308509106BC2207F79AC0D8AE377D9F05374B348702F876D20F0EFB09968C6A6

Function 00E0AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00E0B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00E0B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00E0B1D4
_wcslen.LIBCMT ref: 00E0B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00E0B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00E0B236
_wcslen.LIBCMT ref: 00E0B332

Part of subcall function 00DF05A7: GetStdHandle.KERNEL32(000000F6), ref: 00DF05C6

_wcslen.LIBCMT ref: 00E0B34B
_wcslen.LIBCMT ref: 00E0B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00E0B3B6
GetLastError.KERNEL32(00000000), ref: 00E0B407
CloseHandle.KERNEL32(?), ref: 00E0B439
CloseHandle.KERNEL32(00000000), ref: 00E0B44A
CloseHandle.KERNEL32(00000000), ref: 00E0B45C
CloseHandle.KERNEL32(00000000), ref: 00E0B46E
CloseHandle.KERNEL32(?), ref: 00E0B4E3

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: a27722e0cb8522a70b53feed3df4859f036aad2c853976ac48307644983204ed
Instruction ID: 9a2ae0855763e27686d43cd9043c816884a7a5c24f16ccd2e4c9d5453c661ea1
Opcode Fuzzy Hash: a27722e0cb8522a70b53feed3df4859f036aad2c853976ac48307644983204ed
Instruction Fuzzy Hash: E6F15B316043409FC714EF24C891B6ABBE5FF85714F24855DF895AB2A2DB71EC84CB62

Function 00D8D730 Relevance: 21.6, APIs: 14, Instructions: 631windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00D8D807
timeGetTime.WINMM ref: 00D8DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D8DB28
TranslateMessage.USER32(?), ref: 00D8DB7B
DispatchMessageW.USER32(?), ref: 00D8DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D8DB9F
Sleep.KERNELBASE(0000000A), ref: 00D8DBB1

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 4259b93e32a0320c6361e110b6b764a77c8f738df8153f9556101d90ceab5fee
Instruction ID: 1a7e5f1f7efeca28f0966ef59aba4afd8786328a72f7f3e33c3fe0a9efc5245c
Opcode Fuzzy Hash: 4259b93e32a0320c6361e110b6b764a77c8f738df8153f9556101d90ceab5fee
Instruction Fuzzy Hash: E742CE30604341EFD728EF25C844BAAB7A2FF96314F19855AE495973E1D770E848CBB2

Function 00D82CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00D82D07
RegisterClassExW.USER32(00000030), ref: 00D82D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D82D42
InitCommonControlsEx.COMCTL32(?), ref: 00D82D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D82D6F
LoadIconW.USER32(000000A9), ref: 00D82D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D82D94

Strings

0, xrefs: 00D82CE9
+, xrefs: 00D82CF0
AutoIt v3 GUI, xrefs: 00D82D23
TaskbarCreated, xrefs: 00D82D37

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 29b50bd141c7a40d834d5fb7891a8dbf108b6f609f227be26e91936272969153
Instruction ID: a5999823cca4ceb7783fd251845b82ce792e14979e0bd7c32884077012cda8c0
Opcode Fuzzy Hash: 29b50bd141c7a40d834d5fb7891a8dbf108b6f609f227be26e91936272969153
Instruction Fuzzy Hash: 3621E0B5941308AFDB00DFA6E889BDDBBB4FB48701F20855AF611F62A0D7B14548CF90

Function 00DC065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DC039A: CreateFileW.KERNELBASE(00000000,00000000,?,00DC0704,?,?,00000000,?,00DC0704,00000000,0000000C), ref: 00DC03B7

GetLastError.KERNEL32 ref: 00DC076F
__dosmaperr.LIBCMT ref: 00DC0776
GetFileType.KERNELBASE(00000000), ref: 00DC0782
GetLastError.KERNEL32 ref: 00DC078C
__dosmaperr.LIBCMT ref: 00DC0795
CloseHandle.KERNEL32(00000000), ref: 00DC07B5
CloseHandle.KERNEL32(?), ref: 00DC08FF
GetLastError.KERNEL32 ref: 00DC0931
__dosmaperr.LIBCMT ref: 00DC0938

Strings

H, xrefs: 00DC08BD

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: dbbcce9cdb3b0f56b1bf8da1aeaf931c6385476f1650caefcdef38b467bab999
Instruction ID: 771a65b759f566be9e86e28c7fa20d5992000c3e89349112e6240e72b08e5ab4
Opcode Fuzzy Hash: dbbcce9cdb3b0f56b1bf8da1aeaf931c6385476f1650caefcdef38b467bab999
Instruction Fuzzy Hash: 7EA1F332A042058FDF19AF68D851BAE7FA0EB06320F28415DF815EB3D1DB319916CBB1

Function 00D8344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D83A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00E51418,?,00D82E7F,?,?,?,00000000), ref: 00D83A78

Part of subcall function 00D83357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00D83379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00D8356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00DC318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00DC31CE
RegCloseKey.ADVAPI32(?), ref: 00DC3210
_wcslen.LIBCMT ref: 00DC3277
_wcslen.LIBCMT ref: 00DC3286

Strings

\Include\, xrefs: 00D83527
\, xrefs: 00DC328C
Software\AutoIt v3\AutoIt, xrefs: 00D83560
Include, xrefs: 00DC3184, 00DC31C5

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: d10e3f0347b15962bca53622e7d7c708792cb2c3d54ee387f8296f05a0b1e21d
Instruction ID: c47ad78e7566f86408e5f5875b9decb6784f2ff861214fbffd0b6be035017aa1
Opcode Fuzzy Hash: d10e3f0347b15962bca53622e7d7c708792cb2c3d54ee387f8296f05a0b1e21d
Instruction Fuzzy Hash: 047181714083029EC718EF66DC829ABB7E8FF96750F54482EF645E7160EB349A48CB71

Function 00D82B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00D82B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00D82B9D
LoadIconW.USER32(00000063), ref: 00D82BB3
LoadIconW.USER32(000000A4), ref: 00D82BC5
LoadIconW.USER32(000000A2), ref: 00D82BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00D82BEF
RegisterClassExW.USER32(?), ref: 00D82C40

Part of subcall function 00D82CD4: GetSysColorBrush.USER32(0000000F), ref: 00D82D07
Part of subcall function 00D82CD4: RegisterClassExW.USER32(00000030), ref: 00D82D31
Part of subcall function 00D82CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D82D42
Part of subcall function 00D82CD4: InitCommonControlsEx.COMCTL32(?), ref: 00D82D5F
Part of subcall function 00D82CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D82D6F
Part of subcall function 00D82CD4: LoadIconW.USER32(000000A9), ref: 00D82D85
Part of subcall function 00D82CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D82D94

Strings

0, xrefs: 00D82C0F
AutoIt v3, xrefs: 00D82C2F
#, xrefs: 00D82C16

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 17e91a9d9b73246feda4320c038b493fc1d9d656e94b296b11b6a6ae24bcbe9e
Instruction ID: 77b41be2052eba2a03cb4942926fc63943cfde3f661135bc5227c8054c3616c2
Opcode Fuzzy Hash: 17e91a9d9b73246feda4320c038b493fc1d9d656e94b296b11b6a6ae24bcbe9e
Instruction Fuzzy Hash: 40213A70E40314AFDB149FA7EC65BA97FB4FB48B51F11459AE500F66A0D3B10958CF90

Function 00D8B710 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00D8BB4E

Strings

p%, xrefs: 00D8BB32
p#, xrefs: 00DD0263
x#, xrefs: 00DD0168
p#, xrefs: 00D8BA72
p#, xrefs: 00DD024F
p#, xrefs: 00D8BB6B
p%, xrefs: 00D8B8DC
x#, xrefs: 00DD0207

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: p#$p#$p#$p#$p%$p%$x#$x#
API String ID: 1385522511-4136154834
Opcode ID: 24a8ac2d6f680456946e2b1c9f007f4acc8c91d7bfd7d84cd708d9863d541e91
Instruction ID: e4e2e1b71856d37b140f48248cafdc4bf8af12adbe406da2e8e2949abfa82bfb
Opcode Fuzzy Hash: 24a8ac2d6f680456946e2b1c9f007f4acc8c91d7bfd7d84cd708d9863d541e91
Instruction Fuzzy Hash: D7328E74A002099FDB14EF54C894BBEBBB5EF85320F18805AE945AB361D774ED41CBB1

Function 00D83170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00D8316A,?,?), ref: 00D831D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00D8316A,?,?), ref: 00D83204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D83227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00D8316A,?,?), ref: 00D83232
CreatePopupMenu.USER32 ref: 00D83246
PostQuitMessage.USER32(00000000), ref: 00D83267

Strings

TaskbarCreated, xrefs: 00D8322D

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: bbab02a6975a3eec71653c4bb3cbb1f1a59542b25659752b49f03d422cf8c0dc
Instruction ID: 0b1e4f903b706ae93827e9ca04cc7e541c489ab8ed1f344d946647b8503fb9c3
Opcode Fuzzy Hash: bbab02a6975a3eec71653c4bb3cbb1f1a59542b25659752b49f03d422cf8c0dc
Instruction Fuzzy Hash: 0B415630240300AFDB183B799C1EBBD3A19FB45F41F18056AF94AE61E1CBB0DA4887B5

Function 00D82C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00D82C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00D82CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00D81CAD,?), ref: 00D82CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00D81CAD,?), ref: 00D82CCF

Strings

edit, xrefs: 00D82CAC
AutoIt v3, xrefs: 00D82C89, 00D82C8E, 00D82C8F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: bd1d8a43d8bd3050ec3da526388fcdeaaec546a5282b212ce2020db5ad7b8b17
Instruction ID: 40e99bb08111ca4f935efe95707bc04b10b37354984aa264469cf1d2de45700c
Opcode Fuzzy Hash: bd1d8a43d8bd3050ec3da526388fcdeaaec546a5282b212ce2020db5ad7b8b17
Instruction Fuzzy Hash: 78F03A755803907EEB300B23AC18FBB2EBDD7C6F61F12449AF900F21B0C2A10848DAB0

Function 00DEE97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00DEE997
QueryPerformanceFrequency.KERNEL32(?), ref: 00DEE9A5
Sleep.KERNEL32(00000000), ref: 00DEE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00DEE9B7
Sleep.KERNELBASE ref: 00DEE9F3

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 43364f79b6dae6953901afb82f4e008fa1c2cd83b5d98461fc3621225792c66f
Instruction ID: ceeba77d8ec5fc39427874f66413aecfc6c650841b64e690fd070c75a24ab710
Opcode Fuzzy Hash: 43364f79b6dae6953901afb82f4e008fa1c2cd83b5d98461fc3621225792c66f
Instruction Fuzzy Hash: D6015731D41629EBCF00AFE6DC49AEDFBB8FB08300F104546E502B2242CB309558CBB1

Function 00D83B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00D83B0F,SwapMouseButtons,00000004,?), ref: 00D83B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00D83B0F,SwapMouseButtons,00000004,?), ref: 00D83B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00D83B0F,SwapMouseButtons,00000004,?), ref: 00D83B83

Strings

Control Panel\Mouse, xrefs: 00D83B3E

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 305d7fe26639d3247ffda5f079c4b6e78dee37ec95a90ba62dbde04ef5cee4c0
Instruction ID: 8de61c80725363f9c8043c5009dc8812bdf1c8b48ebc6390f84b0b41083ea42a
Opcode Fuzzy Hash: 305d7fe26639d3247ffda5f079c4b6e78dee37ec95a90ba62dbde04ef5cee4c0
Instruction Fuzzy Hash: 93112AB5510208FFDB20DFA5DC44AEEB7B8EF04B84B148459A809E7110E231EF449760

Function 00D83923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00DC33A2

Part of subcall function 00D86B57: _wcslen.LIBCMT ref: 00D86B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00D83A04

Strings

Line: , xrefs: 00DC33EB

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: af1747b193c5901561165a0ba7e5d7721bcf3f7994083ad10d8eba9ce8a6f732
Instruction ID: f1bb5ee47ca881fbffcbcf38706cd339b3c48e50fd75dad8b292dd084763e4ef
Opcode Fuzzy Hash: af1747b193c5901561165a0ba7e5d7721bcf3f7994083ad10d8eba9ce8a6f732
Instruction Fuzzy Hash: 18318D71408300AED725FB24D855BEEB7E8AB40B10F14496AF599A2091EB749A49CBF2

Function 00D82DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00DC2C8C

Part of subcall function 00D83AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D83A97,?,?,00D82E7F,?,?,?,00000000), ref: 00D83AC2

Part of subcall function 00D82DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00D82DC4

Strings

X, xrefs: 00DC2C5A
`e, xrefs: 00DC2C85

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`e
API String ID: 779396738-4036142377
Opcode ID: 9a282fa2f1ff84af2cd5fb9a3f0d552445b90bce924559c07dad622c3081a54f
Instruction ID: 78895c60f9968370f70f5506e73413e7440e17b7682bd7eb3bb5d2e124245cc1
Opcode Fuzzy Hash: 9a282fa2f1ff84af2cd5fb9a3f0d552445b90bce924559c07dad622c3081a54f
Instruction Fuzzy Hash: 84219371A002589FCF01EF94D845BEE7BF8EF49715F008059E545B7241DBB49A498BB1

Function 00D9FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00DA0668

Part of subcall function 00DA32A4: RaiseException.KERNEL32(?,?,?,00DA068A,?,00E51444,?,?,?,?,?,?,00DA068A,00D81129,00E48738,00D81129), ref: 00DA3304

__CxxThrowException@8.LIBVCRUNTIME ref: 00DA0685

Strings

Unknown exception, xrefs: 00DA0692

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 7816b9f721101fd77751e40850951edd4b5a944f631e429a6d6e2dc4fd836eba
Instruction ID: 41494ce297e0dbb27ed020992613efb8066459828d443dd6b75b694e34d371b4
Opcode Fuzzy Hash: 7816b9f721101fd77751e40850951edd4b5a944f631e429a6d6e2dc4fd836eba
Instruction Fuzzy Hash: B3F0C23490030D778F00B7A4E846D9E7B6C9E42354B644531B814D6591EF71EA65C5F0

Function 00D810F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D81BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D81BF4
Part of subcall function 00D81BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00D81BFC
Part of subcall function 00D81BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D81C07
Part of subcall function 00D81BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D81C12
Part of subcall function 00D81BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00D81C1A
Part of subcall function 00D81BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00D81C22

Part of subcall function 00D81B4A: RegisterWindowMessageW.USER32(00000004,?,00D812C4), ref: 00D81BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00D8136A
OleInitialize.OLE32 ref: 00D81388
CloseHandle.KERNEL32(00000000,00000000), ref: 00DC24AB

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 4370f1550e1738384da01b710f999f7c629b9bd9e58c6c224e6ecee33811a7c6
Instruction ID: fb6b0b295558daec7ca3a7f6dae70bdc3a880e4afaa0ccef8d7344bc9eeabab8
Opcode Fuzzy Hash: 4370f1550e1738384da01b710f999f7c629b9bd9e58c6c224e6ecee33811a7c6
Instruction Fuzzy Hash: D7719BB49013408EC78CEF7BA9467A53AE4EB883467549EAAD41AF7261F730484DCF61

Function 00DEC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D83923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00D83A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00DEC259
KillTimer.USER32(?,00000001,?,?), ref: 00DEC261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00DEC270

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 155e590bd87b7acfa34655c9fb1575ac5b1d7a193470c8122b17d60914269461
Instruction ID: a52b9354fa190b252c950cbf3206729432272a0d330b391cb0e73dc2bd4547b3
Opcode Fuzzy Hash: 155e590bd87b7acfa34655c9fb1575ac5b1d7a193470c8122b17d60914269461
Instruction Fuzzy Hash: 6A31D9709043846FEB32AF7588557E7BBEC9F06308F04549ED2DDA7141C3745A89CB65

Function 00DB86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00DB85CC,?,00E48CC8,0000000C), ref: 00DB8704
GetLastError.KERNEL32(?,00DB85CC,?,00E48CC8,0000000C), ref: 00DB870E
__dosmaperr.LIBCMT ref: 00DB8739

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: a0274f76d35ff38bc894ac3ac665bd67f079715349c91bd56bc70f5e9677dd2a
Instruction ID: fa36efe60103a38c9dc083e08d39470b7004515b69d86ac355d91a18c0844220
Opcode Fuzzy Hash: a0274f76d35ff38bc894ac3ac665bd67f079715349c91bd56bc70f5e9677dd2a
Instruction Fuzzy Hash: 4B010832A05720AAD6647234B845BEE678D8B82B79F3D0159F8169B2D2DEA0CC81E170

Function 00D8DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00D8DB7B
DispatchMessageW.USER32(?), ref: 00D8DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D8DB9F
Sleep.KERNELBASE(0000000A), ref: 00D8DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00DD1CC9

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: fdb2be48faaea767f6d7b38a019f1bf5108d32995b6202729eebe8586edae107
Instruction ID: 68178f202e66d151d612cb167a255e1a6894eb26193996925510f752d80b703d
Opcode Fuzzy Hash: fdb2be48faaea767f6d7b38a019f1bf5108d32995b6202729eebe8586edae107
Instruction Fuzzy Hash: 5FF05E306443409BEB34DBB19C49FEA73B9EB84311F244919E64AD30C0DB70A48CCB35

Function 00D91310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00D917F6

Strings

CALL, xrefs: 00D917C6

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 4a7d2faa2bee81bf0999b85f884665621aac67f702b81aa0067276050971a96f
Instruction ID: d58768ccae3aed03b95570180a1815d05709d1ba209367550ad39cf7d276f22e
Opcode Fuzzy Hash: 4a7d2faa2bee81bf0999b85f884665621aac67f702b81aa0067276050971a96f
Instruction Fuzzy Hash: 6E227A786083429FCB14DF14C480A2ABBF1FF89314F29895DF5969B3A1D771E845CBA2

Function 00D83837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D83908

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: f8b81deee1fcab0dd0b5e47b5bb252a9a8b35a51bc1abda862a69ac05892ae75
Instruction ID: eac93720ced597dbfaaaf1e600fe1a4069df9309bf228044ffc6b22794a09f57
Opcode Fuzzy Hash: f8b81deee1fcab0dd0b5e47b5bb252a9a8b35a51bc1abda862a69ac05892ae75
Instruction Fuzzy Hash: 433191706043019FD720EF25D8947ABBBF8FB49749F04096EF99993250E771AA48CB62

Function 00D9F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00D9F661

Part of subcall function 00D8D730: GetInputState.USER32 ref: 00D8D807

Sleep.KERNEL32(00000000), ref: 00DDF2DE

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 6c721df211a873af7ddd90c593469c8c110428d7a8892a06bd60e978e39f6ecf
Instruction ID: 10ddbbde6dfc2fa1f3424a710d07268fbc11f5709f8f0c3b9c9abdf855f19ea0
Opcode Fuzzy Hash: 6c721df211a873af7ddd90c593469c8c110428d7a8892a06bd60e978e39f6ecf
Instruction Fuzzy Hash: 81F082712803059FD310FF75D845B5ABBE4EF45760F00406AE85AD73A0DB70A840CBB4

Function 00E12598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00E12649

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 87b6d4ba3023982afd7f5a4f12834860d5fa731efa83954028fa8fc8b8fd5967
Instruction ID: f843c4b9134438be208d6eb08910c72683cc30928715a27ce782378ce8933c91
Opcode Fuzzy Hash: 87b6d4ba3023982afd7f5a4f12834860d5fa731efa83954028fa8fc8b8fd5967
Instruction Fuzzy Hash: B9210474200259AFE710DF14CCD0DB6B79AEF4436CB20906CEA969B392C731ED91CBA0

Function 00E113B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00E11420

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 533ee192983867644cbc95e5a7b1b48f7d2631efb0b45ae2934504afee8ea838
Instruction ID: 7cfe50cdc7bb8788737e9fd1173c474217c2027a7849e827213d472b75e607d0
Opcode Fuzzy Hash: 533ee192983867644cbc95e5a7b1b48f7d2631efb0b45ae2934504afee8ea838
Instruction Fuzzy Hash: A531B430204202AFD714EF25C491BA9B7A1FF44328F1491A8E9655B292DB31FC81CFE0

Function 00D84ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D84E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00D84EDD,?,00E51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D84E9C
Part of subcall function 00D84E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00D84EAE
Part of subcall function 00D84E90: FreeLibrary.KERNEL32(00000000,?,?,00D84EDD,?,00E51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D84EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00E51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D84EFD

Part of subcall function 00D84E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00DC3CDE,?,00E51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D84E62
Part of subcall function 00D84E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00D84E74
Part of subcall function 00D84E59: FreeLibrary.KERNEL32(00000000,?,?,00DC3CDE,?,00E51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D84E87

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: b244ac27ccb5e4633f899ff7abfe4ff04ea7fb24575385e97a645d4d32dbfca0
Instruction ID: f0bdb77525693d2c66b9036b2c1a385f2468dbcde654870db5aac653f5504137
Opcode Fuzzy Hash: b244ac27ccb5e4633f899ff7abfe4ff04ea7fb24575385e97a645d4d32dbfca0
Instruction Fuzzy Hash: 3A11C132640306AACB15BF64D812FAD77A5EF40B14F20842EF682A61D1EE709A459770

Function 00DB8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00DB8440

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 15ca0e9bba55ae8b18a57fe0872eb09107afb0beee822b5c80dd5bd51e2d2303
Instruction ID: ec3d11b6a0dc8a53f1057aa28299b187a8abc44d49785890ecab967a347c6c35
Opcode Fuzzy Hash: 15ca0e9bba55ae8b18a57fe0872eb09107afb0beee822b5c80dd5bd51e2d2303
Instruction Fuzzy Hash: 1D11487190420AEFCF05DF58E940ADA7BF9EF48300F144059FC09AB312DA30DA11DBA5

Function 00DB5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DB4C7D: RtlAllocateHeap.NTDLL(00000008,00D81129,00000000,?,00DB2E29,00000001,00000364,?,?,?,00DAF2DE,00DB3863,00E51444,?,00D9FDF5,?), ref: 00DB4CBE

_free.LIBCMT ref: 00DB506C

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 28a8d6abfb4c0952906c773caabed6e18042aec47a970f19b006218dbfa08d48
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 9A012672204705ABE3319E65E881A9AFBE8FB89370F29051DE18583280EA30A805C7B4

Function 00E129BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,00E114B5,?), ref: 00E12A01

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 9a1f062abdd151a779f6c2342344add175e83e96e77662f3ae151e478a3b22c7
Instruction ID: 5b2b8e16ff726ae25a90d96a1b385f09711f41cbbb7452f43664c8c40b374cfa
Opcode Fuzzy Hash: 9a1f062abdd151a779f6c2342344add175e83e96e77662f3ae151e478a3b22c7
Instruction Fuzzy Hash: B801B5363406419FD325CA2DC854BA63792EFC5318F29E46DC247AB251D732FC92C790

Function 00DAE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 738ccf1f0bfbff2d68910ff3e0ee8f245a2626387a918e14b02c1ee6a5ad553a
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 0CF0F432511A10E6D6313B698C05BAA339CDF53330F180F15F426921D2DF70D802CAB9

Function 00E1149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 00E114EB

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: fe4615434faf941814709343b2a2d632b66011d099ea5dc7db2393b003a6a301
Instruction ID: 7e7eca379d4bb8d4439434c7225b454865a3ca023a9f1ed43fae3096a7dcc37c
Opcode Fuzzy Hash: fe4615434faf941814709343b2a2d632b66011d099ea5dc7db2393b003a6a301
Instruction Fuzzy Hash: 7E0142313093419FD320CF6AC8408A6BB94FF8072831490AEEA5ADB302D632DCC2CBD0

Function 00DB4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00D81129,00000000,?,00DB2E29,00000001,00000364,?,?,?,00DAF2DE,00DB3863,00E51444,?,00D9FDF5,?), ref: 00DB4CBE

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dcc53acc9f04f4b55af7dfbf624e8f094541aea8bf60b75ce0e2a647df53d4fe
Instruction ID: d83f89008b5ebe6903e64ca6c3da23730847f7dc07047011b3e4c544fefa3ff6
Opcode Fuzzy Hash: dcc53acc9f04f4b55af7dfbf624e8f094541aea8bf60b75ce0e2a647df53d4fe
Instruction Fuzzy Hash: 20F0B431643224EADB219F669D05BDA3F88AF81BA1B194125F81BE6187CE70DC0046F0

Function 00DB3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00E51444,?,00D9FDF5,?,?,00D8A976,00000010,00E51440,00D813FC,?,00D813C6,?,00D81129), ref: 00DB3852

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e7601183147e5757afd9ed7d89d8ff5bf3f0e6cdf8b40ab2e535c9517862370b
Instruction ID: e32a210587098fa3b1bbfa639d61fcd59730f33c8e747143dc112316be4921b4
Opcode Fuzzy Hash: e7601183147e5757afd9ed7d89d8ff5bf3f0e6cdf8b40ab2e535c9517862370b
Instruction Fuzzy Hash: AFE0E539142324EAD7212AAB9C00BDA3648EF82BB0F1A0030BC46E2590DB50DE01A1F2

Function 00D84F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00E51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D84F6D

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 85f98f6c915a498fe66b6989ee41423c1d02e2a7f3730f762346c5f60b78b53a
Instruction ID: 2630a2bf2955c4bac6bd868c972b450767660d9f262ef3ab6d4db4c126c1e932
Opcode Fuzzy Hash: 85f98f6c915a498fe66b6989ee41423c1d02e2a7f3730f762346c5f60b78b53a
Instruction Fuzzy Hash: ECF03971109752CFDB34AF64D490826BBF4FF143293298E7EE2EA82621C7319848DF20

Function 00E12A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00E12A66

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 3d5bbac0e035e361e5aa0c0d6f3109f6cb2687941671aa08df10f4ca972329e8
Instruction ID: 54721f3a4bf79de56082863981b76f06ef5f36165b252d19d5cb253bfca3c69a
Opcode Fuzzy Hash: 3d5bbac0e035e361e5aa0c0d6f3109f6cb2687941671aa08df10f4ca972329e8
Instruction Fuzzy Hash: 00E04F7639011AAACB14EA31DC848FA735CEF50395710853ABD1AE2100DB30A9A586B0

Function 00D82DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00D82DC4

Part of subcall function 00D86B57: _wcslen.LIBCMT ref: 00D86B6A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 681566f8f8f649722f2d0df5e2a55df2880c8ef8d4621e1e2b7fdbfd1b719d26
Instruction ID: e17156be3b9d4b02e149789653e86533f4fdbf453a990e68fc0a50739d6cd61b
Opcode Fuzzy Hash: 681566f8f8f649722f2d0df5e2a55df2880c8ef8d4621e1e2b7fdbfd1b719d26
Instruction Fuzzy Hash: 3CE0CD766042245BC710A6589C05FDE77DDDFC8790F044075FD09E7258D970ED84C670

Function 00D82B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00D83837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D83908

Part of subcall function 00D8D730: GetInputState.USER32 ref: 00D8D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00D82B6B

Part of subcall function 00D830F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00D8314E

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 859ec0336af6a609024cdbbdfc70b0380932853d74a282a48d9db4c4d420c090
Instruction ID: e1a65f74637292ea23bd7f57895c21674884d31728ec345d1760fbf6aba22c53
Opcode Fuzzy Hash: 859ec0336af6a609024cdbbdfc70b0380932853d74a282a48d9db4c4d420c090
Instruction Fuzzy Hash: 7AE0263130020406CA08BB31A8125BDF359CBD1712F00297EF056931E2CE2049494332

Function 00DE3D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00DE3D18

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: ea0c269d685bb94c5f4e33e51e863a96e3676136754714ccc5bb704f96f9351b
Instruction ID: 76aca0d7433e5bf047c01f9a56145ecf55e77b046151affcbbe6ba6cb9dff269
Opcode Fuzzy Hash: ea0c269d685bb94c5f4e33e51e863a96e3676136754714ccc5bb704f96f9351b
Instruction Fuzzy Hash: 06D012F06A03087EFB0087728C0BEBB329CC316E81F108BA47A02E64C1D9A0DE080130

Function 00DC039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00DC0704,?,?,00000000,?,00DC0704,00000000,0000000C), ref: 00DC03B7

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 88a6f71046eb93d9fef7baaa3e5e9324245dec68d1ade3b376f67711da256de1
Instruction ID: e779d35c86ee34269d82c72a4e4460dfd7eb950fb73d7977074df0733d8c94bd
Opcode Fuzzy Hash: 88a6f71046eb93d9fef7baaa3e5e9324245dec68d1ade3b376f67711da256de1
Instruction Fuzzy Hash: DDD06C3218010DBFDF028F85DD06EDA3BAAFB48714F118000BE58A6020C732E821AB90

Function 00D81CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00D81CBC

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 9b88bbe3368d6aa0492ce4e11d1809dd0051f4366c47b724c864a983172816f9
Instruction ID: f661e72a6348b593af35d18818130e7bed18e10fe0ad82363160408cd46e7c9e
Opcode Fuzzy Hash: 9b88bbe3368d6aa0492ce4e11d1809dd0051f4366c47b724c864a983172816f9
Instruction Fuzzy Hash: D4C092362C0304AFF2198B82BC5AF907765A34CB02F158801F709B95F3D3A22828EA51

Non-executed Functions

Function 00E19576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00D99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D99BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00E1961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00E1965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00E1969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00E196C9
SendMessageW.USER32 ref: 00E196F2
GetKeyState.USER32(00000011), ref: 00E1978B
GetKeyState.USER32(00000009), ref: 00E19798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00E197AE
GetKeyState.USER32(00000010), ref: 00E197B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00E197E9
SendMessageW.USER32 ref: 00E19810
SendMessageW.USER32(?,00001030,?,00E17E95), ref: 00E19918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00E1992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00E19941
SetCapture.USER32(?), ref: 00E1994A
ClientToScreen.USER32(?,?), ref: 00E199AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00E199BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00E199D6
ReleaseCapture.USER32 ref: 00E199E1
GetCursorPos.USER32(?), ref: 00E19A19
ScreenToClient.USER32(?,?), ref: 00E19A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00E19A80
SendMessageW.USER32 ref: 00E19AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00E19AEB
SendMessageW.USER32 ref: 00E19B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00E19B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00E19B4A
GetCursorPos.USER32(?), ref: 00E19B68
ScreenToClient.USER32(?,?), ref: 00E19B75
GetParent.USER32(?), ref: 00E19B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00E19BFA
SendMessageW.USER32 ref: 00E19C2B
ClientToScreen.USER32(?,?), ref: 00E19C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00E19CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00E19CDE
SendMessageW.USER32 ref: 00E19D01
ClientToScreen.USER32(?,?), ref: 00E19D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00E19D82

Part of subcall function 00D99944: GetWindowLongW.USER32(?,000000EB), ref: 00D99952

GetWindowLongW.USER32(?,000000F0), ref: 00E19E05

Strings

@GUI_DRAGID, xrefs: 00E1997D
F, xrefs: 00E19D07
p#, xrefs: 00E19990

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#
API String ID: 3429851547-638943876
Opcode ID: 5606cc471698578158d71fb9034cd441b5e6208f2ca088d58c5afab7fc7b0331
Instruction ID: 89794ac0ce85aa2573e8456609d27b523d4e53ca00b6a3525030788b232cc972
Opcode Fuzzy Hash: 5606cc471698578158d71fb9034cd441b5e6208f2ca088d58c5afab7fc7b0331
Instruction Fuzzy Hash: 3E429E70204201EFD724CF24CC64BEABBE5FF88714F145A59F599A72A2D731E894CB62

Function 00E14873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00E148F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00E14908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00E14927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00E1494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00E1495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00E1497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00E149AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00E149D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00E14A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00E14A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00E14A7E
IsMenu.USER32(?), ref: 00E14A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00E14AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00E14B20
GetWindowLongW.USER32(?,000000F0), ref: 00E14B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00E14BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00E14C82
wsprintfW.USER32 ref: 00E14CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00E14CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00E14CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00E14D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00E14D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00E14D5A

Strings

%d/%02d/%02d, xrefs: 00E14CA8

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 9e2e21c0598e30e55e80d1accee7ec95f45981ffa8b321ef00c6615485d1f6de
Instruction ID: b812c27854566dd9147159b9df04037e5c66f8f96f4a1472670cf4d9b56f5568
Opcode Fuzzy Hash: 9e2e21c0598e30e55e80d1accee7ec95f45981ffa8b321ef00c6615485d1f6de
Instruction Fuzzy Hash: 3512EFB1600214AFEB248F25CC49FEE7BF8EF49714F145129F516EA2E1D7749A81CB60

Function 00DE1201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00DE16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00DE170D
Part of subcall function 00DE16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00DE173A
Part of subcall function 00DE16C3: GetLastError.KERNEL32 ref: 00DE174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00DE1286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00DE12A8
CloseHandle.KERNEL32(?), ref: 00DE12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00DE12D1
GetProcessWindowStation.USER32 ref: 00DE12EA
SetProcessWindowStation.USER32(00000000), ref: 00DE12F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00DE1310

Part of subcall function 00DE10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00DE11FC), ref: 00DE10D4
Part of subcall function 00DE10BF: CloseHandle.KERNEL32(?,?,00DE11FC), ref: 00DE10E9

Strings

winsta0, xrefs: 00DE12CC
default, xrefs: 00DE130B
Z, xrefs: 00DE1392
, xrefs: 00DE125A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Z
API String ID: 22674027-1808616255
Opcode ID: 1ed5ef235f55385be5e80790ff0d845518449e221e1328970a1b18581ebd5560
Instruction ID: d287cae15b9613825b5ef0dd97c16f239d1c4171c4c5d39130b6711468aea213
Opcode Fuzzy Hash: 1ed5ef235f55385be5e80790ff0d845518449e221e1328970a1b18581ebd5560
Instruction Fuzzy Hash: 47817D75A40289AFDF11AFA6DC49BEE7BB9EF04704F188129F911F62A0D7718944CB30

Function 00DE0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00DE1114
Part of subcall function 00DE10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00DE0B9B,?,?,?), ref: 00DE1120
Part of subcall function 00DE10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00DE0B9B,?,?,?), ref: 00DE112F
Part of subcall function 00DE10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00DE0B9B,?,?,?), ref: 00DE1136
Part of subcall function 00DE10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00DE114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00DE0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00DE0C00
GetLengthSid.ADVAPI32(?), ref: 00DE0C17
GetAce.ADVAPI32(?,00000000,?), ref: 00DE0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00DE0C6D
GetLengthSid.ADVAPI32(?), ref: 00DE0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00DE0C8C
HeapAlloc.KERNEL32(00000000), ref: 00DE0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00DE0CB4
CopySid.ADVAPI32(00000000), ref: 00DE0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00DE0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00DE0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00DE0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DE0D45
HeapFree.KERNEL32(00000000), ref: 00DE0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DE0D55
HeapFree.KERNEL32(00000000), ref: 00DE0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DE0D65
HeapFree.KERNEL32(00000000), ref: 00DE0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00DE0D78
HeapFree.KERNEL32(00000000), ref: 00DE0D7F

Part of subcall function 00DE1193: GetProcessHeap.KERNEL32(00000008,00DE0BB1,?,00000000,?,00DE0BB1,?), ref: 00DE11A1
Part of subcall function 00DE1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00DE0BB1,?), ref: 00DE11A8
Part of subcall function 00DE1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00DE0BB1,?), ref: 00DE11B7

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 714ce11c137cedd62c8a9b1af3f2ab3a37efd640a853aa32d29f3a649e1f918d
Instruction ID: 282e16329e15c6969aba247102a8cf55bb291e8cb1aecdd88b5253298d3ef3a1
Opcode Fuzzy Hash: 714ce11c137cedd62c8a9b1af3f2ab3a37efd640a853aa32d29f3a649e1f918d
Instruction Fuzzy Hash: 1F717A7194024AAFDF11EFA6DC44BEEBBBCEF08300F188115E914E6191D7B5A985CB70

Function 00DFEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00E1CC08), ref: 00DFEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00DFEB37
GetClipboardData.USER32(0000000D), ref: 00DFEB43
CloseClipboard.USER32 ref: 00DFEB4F
GlobalLock.KERNEL32(00000000), ref: 00DFEB87
CloseClipboard.USER32 ref: 00DFEB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00DFEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00DFEBC9
GetClipboardData.USER32(00000001), ref: 00DFEBD1
GlobalLock.KERNEL32(00000000), ref: 00DFEBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 00DFEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00DFEC38
GetClipboardData.USER32(0000000F), ref: 00DFEC44
GlobalLock.KERNEL32(00000000), ref: 00DFEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00DFEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00DFEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00DFECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 00DFECF3
CountClipboardFormats.USER32 ref: 00DFED14
CloseClipboard.USER32 ref: 00DFED59

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: e40b5bdc20396b4786e1fd395cb176a7ffb86c296eaa2f4e6e9ed0fcdff5868e
Instruction ID: 3a7b221bb338baf959697b2deab98ef40cf29bdfed3ac16fbca1f0ee234df94f
Opcode Fuzzy Hash: e40b5bdc20396b4786e1fd395cb176a7ffb86c296eaa2f4e6e9ed0fcdff5868e
Instruction Fuzzy Hash: F661DC34204205AFD300EF25C884FBAB7A4EF84704F298559F596E72B2CB31D909CBB2

Function 00DF698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00DF69BE
FindClose.KERNEL32(00000000), ref: 00DF6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00DF6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00DF6A75

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00DF6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00DF6ADF

Strings

%03d, xrefs: 00DF6DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00DF6B6A
%02d, xrefs: 00DF6C00, 00DF6C0A, 00DF6C5A, 00DF6CAA, 00DF6CFA, 00DF6D4A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00DF6B32
%4d, xrefs: 00DF6BB1

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 1f6edeb475746d056ba3fdd4ee97161cfbc24cdfed119082d8e76822fda94df0
Instruction ID: cf497794bc6578fc25a97ad6d77d407895b5e40a73d87ea7bfab7fef50324d9e
Opcode Fuzzy Hash: 1f6edeb475746d056ba3fdd4ee97161cfbc24cdfed119082d8e76822fda94df0
Instruction Fuzzy Hash: F8D14BB2508304AEC710EFA4C891EBBB7E8EF98704F044919F695D6191EB74DA48CB72

Function 00DF9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00DF9663
GetFileAttributesW.KERNEL32(?), ref: 00DF96A1
SetFileAttributesW.KERNEL32(?,?), ref: 00DF96BB
FindNextFileW.KERNEL32(00000000,?), ref: 00DF96D3
FindClose.KERNEL32(00000000), ref: 00DF96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00DF96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00DF974A
SetCurrentDirectoryW.KERNEL32(00E46B7C), ref: 00DF9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00DF9772
FindClose.KERNEL32(00000000), ref: 00DF977F
FindClose.KERNEL32(00000000), ref: 00DF978F

Strings

*.*, xrefs: 00DF96F5

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 9cef5260f63833efef7fe6d8756754a169ea1eff047fedab852a8ba37b589f3b
Instruction ID: 5bf96d2a5b2a1e2c0f91a4e3296a6414b6bf4a0945515ceb867b417003b1466a
Opcode Fuzzy Hash: 9cef5260f63833efef7fe6d8756754a169ea1eff047fedab852a8ba37b589f3b
Instruction Fuzzy Hash: CF31AE3294071D6EDB10AFB5EC18BEEB7AC9F09321F258155FA15E20A0DB74DA44CA74

Function 00DF979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00DF97BE
FindNextFileW.KERNEL32(00000000,?), ref: 00DF9819
FindClose.KERNEL32(00000000), ref: 00DF9824
FindFirstFileW.KERNEL32(*.*,?), ref: 00DF9840
SetCurrentDirectoryW.KERNEL32(?), ref: 00DF9890
SetCurrentDirectoryW.KERNEL32(00E46B7C), ref: 00DF98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00DF98B8
FindClose.KERNEL32(00000000), ref: 00DF98C5
FindClose.KERNEL32(00000000), ref: 00DF98D5

Part of subcall function 00DEDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00DEDB00

Strings

*.*, xrefs: 00DF983B

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: db96cab37c1662070bff8e1b1ac8cdd02b2e35d78fbf2b834f069bb2b3a6326d
Instruction ID: 43591b71b4ad6c3b4a10cbb44dbde8ff12bd27618a8b25df6f0d73244b848e65
Opcode Fuzzy Hash: db96cab37c1662070bff8e1b1ac8cdd02b2e35d78fbf2b834f069bb2b3a6326d
Instruction Fuzzy Hash: 3731D23194061D6EDB10AFB5EC58BEEB7ACDF06360F258156E914F20A0DB30DA89CA74

Function 00E0BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E0C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E0B6AE,?,?), ref: 00E0C9B5
Part of subcall function 00E0C998: _wcslen.LIBCMT ref: 00E0C9F1
Part of subcall function 00E0C998: _wcslen.LIBCMT ref: 00E0CA68
Part of subcall function 00E0C998: _wcslen.LIBCMT ref: 00E0CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E0BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00E0BFA9
RegCloseKey.ADVAPI32(00000000), ref: 00E0BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00E0C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00E0C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00E0C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00E0C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00E0C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00E0C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00E0C382
RegCloseKey.ADVAPI32(00000000), ref: 00E0C38F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: e6fd6c86dfbb9c44b77b5b375efa94c3c763481961183160aa5da87f7ddda9c9
Instruction ID: 3a0e1cbbd6e72c294bba4095e1bdcb9f1c7983e423346140bf2af90b7bb1c4bf
Opcode Fuzzy Hash: e6fd6c86dfbb9c44b77b5b375efa94c3c763481961183160aa5da87f7ddda9c9
Instruction Fuzzy Hash: B5024E716042009FD714DF24C895E2ABBE5EF49318F28C59DF449DB2A2D731ED85CB61

Function 00DF8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00DF8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00DF8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00DF8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00DF8310
SetCurrentDirectoryW.KERNEL32(?), ref: 00DF8324
SetCurrentDirectoryW.KERNEL32(?), ref: 00DF8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00DF838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00DF8395

Strings

*.*, xrefs: 00DF839B

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 0498b320ab9fa2cdbb65efd271690a29e3b4781fb46f35aafd171d335127a994
Instruction ID: 9ef877532088f0b2476add153328718bf5b99d166b1c47856627f5468a139101
Opcode Fuzzy Hash: 0498b320ab9fa2cdbb65efd271690a29e3b4781fb46f35aafd171d335127a994
Instruction Fuzzy Hash: B26159B25043499FC710EF64C8409AEB3E8FF89314F15891AFA99D7251DB31E945CBB2

Function 00DED076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D83AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D83A97,?,?,00D82E7F,?,?,?,00000000), ref: 00D83AC2

Part of subcall function 00DEE199: GetFileAttributesW.KERNEL32(?,00DECF95), ref: 00DEE19A

FindFirstFileW.KERNEL32(?,?), ref: 00DED122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00DED1DD
MoveFileW.KERNEL32(?,?), ref: 00DED1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00DED20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00DED237

Part of subcall function 00DED29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00DED21C,?,?), ref: 00DED2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00DED253
FindClose.KERNEL32(00000000), ref: 00DED264

Strings

\*.*, xrefs: 00DED0CD, 00DED0D6, 00DED0EB

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 2993af06ea16d5c53640b640416eb0536ad9763aa4ee162cf559da232e382ac1
Instruction ID: d1fe127cf3d7d3d5bf36c10bd2ea2417aef10cd830efe58007f61551b5ed5690
Opcode Fuzzy Hash: 2993af06ea16d5c53640b640416eb0536ad9763aa4ee162cf559da232e382ac1
Instruction Fuzzy Hash: 76614831805249AACF05FBE1CA929EDB776EF15300F688165E44677191EF31AF09CB71

Function 00DFED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00DFED91
EmptyClipboard.USER32 ref: 00DFED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00DFEDAC
CloseClipboard.USER32 ref: 00DFEEA3

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 453acdafa0d70b5b97d937940ff39ed69db3573b30a96d817e9f3b7382c85a74
Instruction ID: ae08c5a2886e64f7447ad77e39115872f1dd8669a79f250010ecade0d70579d1
Opcode Fuzzy Hash: 453acdafa0d70b5b97d937940ff39ed69db3573b30a96d817e9f3b7382c85a74
Instruction Fuzzy Hash: A141CD31204611AFE320DF16E888B69BBE1EF44318F29C099E5559BA72C735EC41CBA0

Function 00DEE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00DE170D
Part of subcall function 00DE16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00DE173A
Part of subcall function 00DE16C3: GetLastError.KERNEL32 ref: 00DE174A

ExitWindowsEx.USER32(?,00000000), ref: 00DEE932

Strings

, xrefs: 00DEE95C
SeShutdownPrivilege, xrefs: 00DEE902
@, xrefs: 00DEE925
, xrefs: 00DEE920

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 3b3fdcc9a444298fca32fec5e150ec0d9476286085560cf9a993b3066fab8957
Instruction ID: e41dd2c1d0f20c6b6fe47cafcb42ffdeb352a00e4532697cb1d2abc68b36beb4
Opcode Fuzzy Hash: 3b3fdcc9a444298fca32fec5e150ec0d9476286085560cf9a993b3066fab8957
Instruction Fuzzy Hash: BF01D672650251AFEB5477B7AC86FFB739C9718750F194421F902F71D3E6A09C4489B0

Function 00E01204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00E01276
WSAGetLastError.WSOCK32 ref: 00E01283
bind.WSOCK32(00000000,?,00000010), ref: 00E012BA
WSAGetLastError.WSOCK32 ref: 00E012C5
closesocket.WSOCK32(00000000), ref: 00E012F4
listen.WSOCK32(00000000,00000005), ref: 00E01303
WSAGetLastError.WSOCK32 ref: 00E0130D
closesocket.WSOCK32(00000000), ref: 00E0133C

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 73c73b67c1d87e57e5733f017b5a488a9acb0a8fd37d74d23602f9e805d99378
Instruction ID: 26b2f0793f39d09fbee844cb5d1ba728504c416e95bd9afed015078876a7317a
Opcode Fuzzy Hash: 73c73b67c1d87e57e5733f017b5a488a9acb0a8fd37d74d23602f9e805d99378
Instruction Fuzzy Hash: 02418E316001409FD714DF68C488B69BBE5AF86318F2891D8E856AF2E2C771EC85CBA1

Function 00DED3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D83AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D83A97,?,?,00D82E7F,?,?,?,00000000), ref: 00D83AC2

Part of subcall function 00DEE199: GetFileAttributesW.KERNEL32(?,00DECF95), ref: 00DEE19A

FindFirstFileW.KERNEL32(?,?), ref: 00DED420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00DED470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00DED481
FindClose.KERNEL32(00000000), ref: 00DED498
FindClose.KERNEL32(00000000), ref: 00DED4A1

Strings

\*.*, xrefs: 00DED3F2

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: a5015d55d49b443205205ed458e8c230cacb9f003a78a43807604e4178638c99
Instruction ID: e7d3e42e23711c039ae10c2a6d7278f18689ffd354b3867baa2d485de47c4707
Opcode Fuzzy Hash: a5015d55d49b443205205ed458e8c230cacb9f003a78a43807604e4178638c99
Instruction Fuzzy Hash: 7F315C71008385AFC305FF65D8918AFB7A9EEA5314F444A1EF4D5921A1EB30EA09CB73

Function 00DBE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00DBE645

Strings

1#QNAN, xrefs: 00DBF84B
1#IND, xrefs: 00DBF83D
1#SNAN, xrefs: 00DBF844
1#INF, xrefs: 00DBF852

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: eb2484ab345d204d3665b72be3901a349fd2c61d6d63bca8dc6456a57e4bc9ae
Instruction ID: 2d629d6be6acf22420cdb0fac4495f9ea69ad7925e47f8487a1e8ad2465d8334
Opcode Fuzzy Hash: eb2484ab345d204d3665b72be3901a349fd2c61d6d63bca8dc6456a57e4bc9ae
Instruction Fuzzy Hash: 1EC20872E04628CFDB25CF289D407EAB7B5EB49305F1845EAD44EE7241E774AE818F60

Function 00DF648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DF64DC
CoInitialize.OLE32(00000000), ref: 00DF6639
CoCreateInstance.OLE32(00E1FCF8,00000000,00000001,00E1FB68,?), ref: 00DF6650
CoUninitialize.OLE32 ref: 00DF68D4

Strings

.lnk, xrefs: 00DF64BA, 00DF6524, 00DF65E0

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: ec06601dcf14081aedd8f2a5c7c69e5c997cc7846fdc0e3395c52a5102220d73
Instruction ID: 975af35f35b6193eee6319cc44d8d3e48f5da343550d7526d20364363a5d9d51
Opcode Fuzzy Hash: ec06601dcf14081aedd8f2a5c7c69e5c997cc7846fdc0e3395c52a5102220d73
Instruction Fuzzy Hash: A7D15871508305AFC304EF24C89196BB7E8FF98304F14896DF5959B2A1EB71E909CBB2

Function 00E022DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00E022E8

Part of subcall function 00DFE4EC: GetWindowRect.USER32(?,?), ref: 00DFE504

GetDesktopWindow.USER32 ref: 00E02312
GetWindowRect.USER32(00000000), ref: 00E02319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00E02355
GetCursorPos.USER32(?), ref: 00E02381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00E023DF

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 13eff2fa60970821b92fbdeda749edcab49bcc5e84997468adc97c082d62086a
Instruction ID: e8481f083ae6f364c8529b8764c12c578e3788588b68b740a5c18f3f9450553d
Opcode Fuzzy Hash: 13eff2fa60970821b92fbdeda749edcab49bcc5e84997468adc97c082d62086a
Instruction Fuzzy Hash: E631DE72104316AFCB20DF15C808B9BBBEAFB84314F10591DFA84E7181DA34E948CBA2

Function 00DF9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00DF9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00DF9C8B

Part of subcall function 00DF3874: GetInputState.USER32 ref: 00DF38CB
Part of subcall function 00DF3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DF3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00DF9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00DF9C75

Strings

*.*, xrefs: 00DF9B5D

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: af57c3ebf148ca237b3a3e05377eacb0675965693ba6c2085dc5abfc2b955c5e
Instruction ID: c3ebd9e5d7dce378c8faa0da1c0c2f61dfd6d5f368900c7543c70419b079f53c
Opcode Fuzzy Hash: af57c3ebf148ca237b3a3e05377eacb0675965693ba6c2085dc5abfc2b955c5e
Instruction Fuzzy Hash: 19414A71D4420AAFCB14EF64C895BEEBBB8EF05310F248056E919A2191EB309E84CB70

Function 00D9997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00D99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D99BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00D99A4E
GetSysColor.USER32(0000000F), ref: 00D99B23
SetBkColor.GDI32(?,00000000), ref: 00D99B36

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 1a9cf926054ae254baf0abcd76225cae6670553c3d197d726567305b76153a20
Instruction ID: 5a6877540e715c5724914199b8503ab8c062407cdca73f9c912372562a3f4b82
Opcode Fuzzy Hash: 1a9cf926054ae254baf0abcd76225cae6670553c3d197d726567305b76153a20
Instruction Fuzzy Hash: 53A12970208504BFEF289A3D8CB9FBFB69DDB86310F18464EF442E6691DA25DD41C272

Function 00E01806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E0304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00E0307A
Part of subcall function 00E0304E: _wcslen.LIBCMT ref: 00E0309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00E0185D
WSAGetLastError.WSOCK32 ref: 00E01884
bind.WSOCK32(00000000,?,00000010), ref: 00E018DB
WSAGetLastError.WSOCK32 ref: 00E018E6
closesocket.WSOCK32(00000000), ref: 00E01915

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 24ef26541cd6fa0645be1d08c898a51abfb494102cb8256e92282c7f56588c22
Instruction ID: cea772610e56ae0936222d2c164a018773f724a33cbe8fbd92801fd2c33c83d5
Opcode Fuzzy Hash: 24ef26541cd6fa0645be1d08c898a51abfb494102cb8256e92282c7f56588c22
Instruction Fuzzy Hash: EA519171A00200AFEB14AF24D886F6A77E5EF44718F588098FA15AF2D3C671AD418BB1

Function 00E11C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00E11CC0
IsWindowEnabled.USER32 ref: 00E11CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00E11CDB
IsIconic.USER32 ref: 00E11CE9
IsZoomed.USER32 ref: 00E11CF7

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 8677073161a840bcf2621f427f65bf88d7de7d01584f34165433e75466bd2a9a
Instruction ID: 5929f340eb35e7e7c803e9658ab4cb274f2bc0cb398d39756762c61ea6e38b42
Opcode Fuzzy Hash: 8677073161a840bcf2621f427f65bf88d7de7d01584f34165433e75466bd2a9a
Instruction Fuzzy Hash: EB21D6317802005FD7248F2AD844BDABBE5EF85319B19909CE946EB351C771DC82CBE0

Function 00D88060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00D8813C
VUUU, xrefs: 00D8843C
VUUU, xrefs: 00D883FA
VUUU, xrefs: 00D883E8
VUUU, xrefs: 00DC5DF0

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 5da76489753ee087dc213905141c99294b3f6595ee141ef56e0d59da3767e49a
Instruction ID: c43b1211ef30e0e27c01be49b8ec8804c4fb67b499132a3115ea74879932f511
Opcode Fuzzy Hash: 5da76489753ee087dc213905141c99294b3f6595ee141ef56e0d59da3767e49a
Instruction Fuzzy Hash: D3A28071E0061ACBDF24DF58C941BADB7B2BF54310F6881AAE855A7285EB30DD81DF60

Function 00DE8298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00DE82AA

Strings

(, xrefs: 00DE82F0
tb, xrefs: 00DE84F4
|, xrefs: 00DE82DA

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($tb$|
API String ID: 1659193697-1968160224
Opcode ID: db1c54358488cc375b7c3728db24665ee8c307964e9c1f39320aad8855dfbd6b
Instruction ID: f56fc1f64a71989cf1f8d5a0451203e4a5c3153299d806b4b3453f21a0f886cd
Opcode Fuzzy Hash: db1c54358488cc375b7c3728db24665ee8c307964e9c1f39320aad8855dfbd6b
Instruction Fuzzy Hash: 97324474A007459FCB28DF5AC081A6AB7F0FF48710B15C46EE49ADB3A1EB70E941CB60

Function 00E0A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00E0A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00E0A6BA

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

Process32NextW.KERNEL32(00000000,?), ref: 00E0A79C
CloseHandle.KERNEL32(00000000), ref: 00E0A7AB

Part of subcall function 00D9CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00DC3303,?), ref: 00D9CE8A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: ea4515a06fc8dacc7741b80cdc29998e46cfa3ff5e5b178508929e0a50a9f49a
Instruction ID: 29f7e1b9ebad5266927de1e15077b8b89d05287d6f68599614bb28fc8ac0db3c
Opcode Fuzzy Hash: ea4515a06fc8dacc7741b80cdc29998e46cfa3ff5e5b178508929e0a50a9f49a
Instruction Fuzzy Hash: 99515A71508311AFD710EF25D886A6BBBF8FF89754F04892DF585A7291EB30D904CBA2

Function 00DEAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00DEAAAC
SetKeyboardState.USER32(00000080), ref: 00DEAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00DEAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00DEAB88

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: fadd97f330acf2cb763b0fa6313ae33dde52828ca0beefef342bbaf76f750b4b
Instruction ID: 0835a39ad0c1296195c3dabc5a22458b2c07bbd70443a02e0d4264593fcd9063
Opcode Fuzzy Hash: fadd97f330acf2cb763b0fa6313ae33dde52828ca0beefef342bbaf76f750b4b
Instruction Fuzzy Hash: C7312A30A40389AEFB31AA6ECC05BFA77A6AB54710F18421AF181961D0D374A985C772

Function 00DBBB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00DBBB7F

Part of subcall function 00DB29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00DBD7D1,00000000,00000000,00000000,00000000,?,00DBD7F8,00000000,00000007,00000000,?,00DBDBF5,00000000), ref: 00DB29DE
Part of subcall function 00DB29C8: GetLastError.KERNEL32(00000000,?,00DBD7D1,00000000,00000000,00000000,00000000,?,00DBD7F8,00000000,00000007,00000000,?,00DBDBF5,00000000,00000000), ref: 00DB29F0

GetTimeZoneInformation.KERNEL32 ref: 00DBBB91
WideCharToMultiByte.KERNEL32(00000000,?,00E5121C,000000FF,?,0000003F,?,?), ref: 00DBBC09
WideCharToMultiByte.KERNEL32(00000000,?,00E51270,000000FF,?,0000003F,?,?,?,00E5121C,000000FF,?,0000003F,?,?), ref: 00DBBC36

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 7d55b8df78c134ce4a69ec112daf7cdbf99f54a1dca9deced0353ac6aee9088c
Instruction ID: fd49670a286893d6b7de13d1b4b58623f5fa87c0c10db6939178b70479a49c6f
Opcode Fuzzy Hash: 7d55b8df78c134ce4a69ec112daf7cdbf99f54a1dca9deced0353ac6aee9088c
Instruction Fuzzy Hash: 4B31C370944205EFCB14DF69CC815ADBBB8FF45760B184A9AE052E72B1D7709D44DB60

Function 00DFCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00DFCE89
GetLastError.KERNEL32(?,00000000), ref: 00DFCEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00DFCEFE

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 8c44a44eb6dfed887f695b56b595e4bbafdd44fba4e95ecdd3c7b84f00787688
Instruction ID: b5a5aae8f9effbb8d6e482b9c87adbcf9fee1177bbb4024c68489b0750787ea8
Opcode Fuzzy Hash: 8c44a44eb6dfed887f695b56b595e4bbafdd44fba4e95ecdd3c7b84f00787688
Instruction Fuzzy Hash: F121AC7165070DAFDB20CF65DA48BA6B7F8EF40318F25881AE646E2151E770EA18CB70

Function 00DF5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00DF5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00DF5D17
FindClose.KERNEL32(?), ref: 00DF5D5F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 0a5a6b7fb65545712966bfcd3ca27deaf9ad3901f962ea77276a4aaddc094e23
Instruction ID: 86fd2ef66fd73e5176de0ffb6dd4b377de36d4b5a4111619de1d57dd4f60a7b1
Opcode Fuzzy Hash: 0a5a6b7fb65545712966bfcd3ca27deaf9ad3901f962ea77276a4aaddc094e23
Instruction Fuzzy Hash: 0351AD34604A059FC714DF28D884AAAB7E4FF4A314F15855DEA5A8B3A1CB30ED44CBA1

Function 00DB2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00DB271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00DB2724
UnhandledExceptionFilter.KERNEL32(?), ref: 00DB2731

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 5a28dc806c5738319e03a361094fcf7260d93f2261a32cec58c5a374d40d23d8
Instruction ID: d6a6cfeadfa4dcd7e0a7f80da1176a5c9687f283010234bda4050a911513833c
Opcode Fuzzy Hash: 5a28dc806c5738319e03a361094fcf7260d93f2261a32cec58c5a374d40d23d8
Instruction Fuzzy Hash: B231D375941218ABCB21DF69DC887DCBBB8EF08710F5041EAE81CA7260EB309F858F55

Function 00DF51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00DF51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00DF5238
SetErrorMode.KERNEL32(00000000), ref: 00DF52A1

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: f6335db2ccbf63fc8938753bdc87e1e47e53f12d473b759c0fd2e2bdc378eacd
Instruction ID: 41a8ef55e422a22a7f5bb2b80d4c1e788234ca070f26f6b37ab9b42a707ecc90
Opcode Fuzzy Hash: f6335db2ccbf63fc8938753bdc87e1e47e53f12d473b759c0fd2e2bdc378eacd
Instruction Fuzzy Hash: C3318135A00508DFDB00EF55D884EADBBB4FF49318F198099E905AB366CB31E845CBA0

Function 00DE16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00D9FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00DA0668
Part of subcall function 00D9FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00DA0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00DE170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00DE173A
GetLastError.KERNEL32 ref: 00DE174A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 17d5c48201bf3e5de2707d26df270d6917994ddbed5a826ce15db7891f30a116
Instruction ID: 4ffe2f95bcd719ea0b4eafd91216fc70cb6f98ba5d79b3fa7b7933473568ae36
Opcode Fuzzy Hash: 17d5c48201bf3e5de2707d26df270d6917994ddbed5a826ce15db7891f30a116
Instruction Fuzzy Hash: 3311CEB2510304AFD718AF55DC86DAAB7B9EB08B14B20852EE05697241EB70FC42CA30

Function 00DED5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00DED608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00DED645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00DED650

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: b6d568af5fc83197fb48605873c6d8e8d12ab64b620879b1ec2156f40883d41d
Instruction ID: 87cba813c13f6dab54706f2daee760b7cfdc0ffa1a4d3e41b83e84cf098a2f87
Opcode Fuzzy Hash: b6d568af5fc83197fb48605873c6d8e8d12ab64b620879b1ec2156f40883d41d
Instruction Fuzzy Hash: 0D117C71E41228BFDB108F959C44FEFBBBCEB45B50F108115F914E7290C6704A058BA1

Function 00DE1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00DE168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00DE16A1
FreeSid.ADVAPI32(?), ref: 00DE16B1

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: c440d90393736c10e9ef4105b096db00b401e5b00a34be8e749c9af3138326a5
Instruction ID: 03f4510a440a5abe8614abd8551e30d7a0e1e099beceab38c2f97ee5e62e7dc2
Opcode Fuzzy Hash: c440d90393736c10e9ef4105b096db00b401e5b00a34be8e749c9af3138326a5
Instruction Fuzzy Hash: D0F0F475990309FFDB00DFE59C89EAEBBBCEB08604F508565E501E2181E774AA489A60

Function 00DA4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00DB28E9,?,00DA4CBE,00DB28E9,00E488B8,0000000C,00DA4E15,00DB28E9,00000002,00000000,?,00DB28E9), ref: 00DA4D09
TerminateProcess.KERNEL32(00000000,?,00DA4CBE,00DB28E9,00E488B8,0000000C,00DA4E15,00DB28E9,00000002,00000000,?,00DB28E9), ref: 00DA4D10
ExitProcess.KERNEL32 ref: 00DA4D22

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 047a072164bb437c8ede59c3c0e27bc2473a8f4188b8c5ce6baf7159b8c24737
Instruction ID: 8da287ca690f8ec5084fdbd711269059fd3359a882c8fbf515544f7a00a260cb
Opcode Fuzzy Hash: 047a072164bb437c8ede59c3c0e27bc2473a8f4188b8c5ce6baf7159b8c24737
Instruction Fuzzy Hash: B8E04631040108AFCF11AF15DD09A883B29EB82781B248018FD15DA122CB75DE42CAA0

Function 00DDD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00DDD28C

Strings

X64, xrefs: 00DDD2A8

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 1a474bc027c6b88cc62989697e2f7dabd972c71104c6d0ef80355533f4e627d3
Instruction ID: 47985b96b55a39b3e9b250bd39f0ae9f081295f1cab3572ac0ff547cd8927f8f
Opcode Fuzzy Hash: 1a474bc027c6b88cc62989697e2f7dabd972c71104c6d0ef80355533f4e627d3
Instruction Fuzzy Hash: BED0C9B480111DEECFA4CB90DC88DD9B77CBB04345F104152F186E2100D73095488F20

Function 00DACAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 5bf3322b4ea49cdd7336a567c7323a7fcf708c68fe6665603d256155edf41f7b
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 08022D71E112199FDF14CFA9C8806ADFBF1EF49324F294169E819E7380D731AE418BA4

Function 00D8CAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

p#, xrefs: 00D8CF7F
Variable is not of type 'Object'., xrefs: 00DD0C40

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#
API String ID: 0-1086706999
Opcode ID: 5dc0957aff39df4281772f6cbcc8ce11253ff1b75b4fed315dba8c3fd0c79f29
Instruction ID: 9b9a05cc820655d023b5c7e50d48c5bc97095c47f85ae908e867360fde2591d0
Opcode Fuzzy Hash: 5dc0957aff39df4281772f6cbcc8ce11253ff1b75b4fed315dba8c3fd0c79f29
Instruction Fuzzy Hash: E5329970910208DBDF14EF94D881BEDBBB5FF45308F28905AE946AB292D771AE45CB70

Function 00DF68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00DF6918
FindClose.KERNEL32(00000000), ref: 00DF6961

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: a456d6dca51ff4f9092dd214a13bb62f4127c663c0af968cfff70627f480e7ff
Instruction ID: 7459de4cbb9a99b791170efaa2f997894c1394dd1daaba924bfa783ccd54cef4
Opcode Fuzzy Hash: a456d6dca51ff4f9092dd214a13bb62f4127c663c0af968cfff70627f480e7ff
Instruction Fuzzy Hash: C711D0316046009FD710DF29D484A2ABBE0FF84328F19C699E5698F6A2C770EC05CBA0

Function 00DF37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00E04891,?,?,00000035,?), ref: 00DF37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00E04891,?,?,00000035,?), ref: 00DF37F4

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 54c1d6305324dbbbf0fbce04f3f0f2b7a49b452b5c1630b2068a73fd037e2189
Instruction ID: 5076e90a1cad68c9d98d164228b0d8bd6aa9d7639c9919c99dcc9224468b098f
Opcode Fuzzy Hash: 54c1d6305324dbbbf0fbce04f3f0f2b7a49b452b5c1630b2068a73fd037e2189
Instruction Fuzzy Hash: B5F055B06042282AE72027A68C4CFEB3AAEEFC4760F004164F209E3281C9A08944C7B0

Function 00DE10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00DE11FC), ref: 00DE10D4
CloseHandle.KERNEL32(?,?,00DE11FC), ref: 00DE10E9

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 0436e7c74d84878e7431ee378834b73131a40fc6901a93706cf87288d72235fb
Instruction ID: e602b64dba52c61aabc223b8cd9dc05d180067849fa50ed4dd1330470eebc9a2
Opcode Fuzzy Hash: 0436e7c74d84878e7431ee378834b73131a40fc6901a93706cf87288d72235fb
Instruction Fuzzy Hash: D5E0BF72154610AFEB252B52FC05EB777A9EB04310B24C82DF5A5D04B1DB626C90DB60

Function 00D8BF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

p#, xrefs: 00DD07CE

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: BuffCharUpper
String ID: p#
API String ID: 3964851224-4182048217
Opcode ID: ec3d5c6b67057ebbcf9b6c9ba63c830c7f9943b6cb7e78aafdb4fb50807be6e6
Instruction ID: 0f2bce4ba2384d93347f54fd71cec41790dd9e2cd4628f585d9b0511ca2eb7de
Opcode Fuzzy Hash: ec3d5c6b67057ebbcf9b6c9ba63c830c7f9943b6cb7e78aafdb4fb50807be6e6
Instruction Fuzzy Hash: 62A20870618341DFD714EF18C480B2ABBE1FB89304F18996EE9999B352D771E845CBB2

Function 00DB676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00DB6766,?,?,00000008,?,?,00DBFEFE,00000000), ref: 00DB6998

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 904642b256674b6f25dca2153383c0dcd15498379d32c042d1f5cf82cd26a8e7
Instruction ID: adbf870cde88613720c2a19af4bb3f627062752ff0959c63ad632989d3f09e11
Opcode Fuzzy Hash: 904642b256674b6f25dca2153383c0dcd15498379d32c042d1f5cf82cd26a8e7
Instruction Fuzzy Hash: E8B12B35510608DFDB15CF28C486BA57BE0FF45364F298658E8DACF2A2C739E991CB50

Function 00D9B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00DD851F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ce7eeeb7671d01b093ff7a85e96b5976789fa73a9d5940a29277df1c9b51f2af
Instruction ID: f77f24d7ac99c85238c1109cbcfcf74bede819bd697c8151c9f86e1b8d8170f0
Opcode Fuzzy Hash: ce7eeeb7671d01b093ff7a85e96b5976789fa73a9d5940a29277df1c9b51f2af
Instruction Fuzzy Hash: 1A125E719002299FCF25CF58D9816EEB7F5FF48710F1581AAE849EB251DB309A81DFA0

Function 00DFEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00DFEABD

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 6d2b3a0abe6e0569de0f2a82ff92cf7eb939ffb0177d1d8867c63c8f0100accf
Instruction ID: efac13f3f26d9b6c3309361f2f3ed6b3540dfa0d8b5e58bc8fe46c773f1b2833
Opcode Fuzzy Hash: 6d2b3a0abe6e0569de0f2a82ff92cf7eb939ffb0177d1d8867c63c8f0100accf
Instruction Fuzzy Hash: EFE01A312102049FD710EF5AD804E9ABBE9EF98760F01C416FD49D7261DA70E8408BB0

Function 00DA09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00DA03EE), ref: 00DA09DA

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f07c86cd4028f91936c546c8cc9e42e1ed1b0d281c569cde5ca1c61262fe1804
Instruction ID: d7e6596afc06508e18bbd3b4fcd40b070a6f77c32b63e8e4bac5a95befbd5dd4
Opcode Fuzzy Hash: f07c86cd4028f91936c546c8cc9e42e1ed1b0d281c569cde5ca1c61262fe1804
Instruction Fuzzy Hash:

Function 00DA781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00DA798B

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 0a91f06fb37746ab63d453bb9ae3e66d9aefebaabb9bbf06531c4584b5e75a2a
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: C4513472B0C6056BDB3886788C5ABBF6789DB03340F1C091AD886D7282CB19DE45E776

Function 00DF2046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&, xrefs: 00DF2053

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID: 0&
API String ID: 0-2523485602
Opcode ID: 8d32df45c8e8723512389bc6c7749c2455931274872771318f40106062ee6b02
Instruction ID: 2b25e0dfeadd0e3fb70197ad09dec24b931cd975a17d93cab22af9a6bfddb73a
Opcode Fuzzy Hash: 8d32df45c8e8723512389bc6c7749c2455931274872771318f40106062ee6b02
Instruction Fuzzy Hash: AA21A8327206158BDB2CCE79C81367A73E5A754310F198A2EE5A7D37D0DE75A904C790

Function 00DB6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c223a77b0cac97db75d0936f187893b949c9c2390fd5ea65faf605a4297f5e8
Instruction ID: e11673bcff82719dd1e416f6c68cef5200943a29b8d3fdd3ef74e9946d003c6c
Opcode Fuzzy Hash: 1c223a77b0cac97db75d0936f187893b949c9c2390fd5ea65faf605a4297f5e8
Instruction Fuzzy Hash: F7321422D29F418ED7339639CC22335A689AFF73C5F15D73BE81AB59A5EB29C4835100

Function 00D9CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642c998934dbcc3983616af739d99bf1cef5f49700922cdd736ed8420b194406
Instruction ID: f14b63fe3da31bf0c93c22560f9e706e4a3b65b466abf29f3e9654a5d0dcb21a
Opcode Fuzzy Hash: 642c998934dbcc3983616af739d99bf1cef5f49700922cdd736ed8420b194406
Instruction Fuzzy Hash: C4320331A601178BDF28CF69C49067D7BA2EB85300F2DA56BD48ADB391D630DD81DB71

Function 00D87920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2806b76daf78cb06568c43fec5e7edf559b5faafc2636349e59b450dbdb8b098
Instruction ID: db24936e31e0922e520b6bdbf068a07598309d7e5a22d3d26bfe40a52f8177dd
Opcode Fuzzy Hash: 2806b76daf78cb06568c43fec5e7edf559b5faafc2636349e59b450dbdb8b098
Instruction Fuzzy Hash: 2122BFB0A0460A9FDF14DF64D881BAEB7F6FF44300F244229E856A7295EB35E951CB70

Function 00D891C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60cc3e99e22fc49c5bc00d19d4e690535e7a158127210ec3a02881bfc99d65a7
Instruction ID: d180329328535ff128ebe6233fcaca652cc8fe47100c2884639601d937163be1
Opcode Fuzzy Hash: 60cc3e99e22fc49c5bc00d19d4e690535e7a158127210ec3a02881bfc99d65a7
Instruction Fuzzy Hash: 6D02A4B0A00206EFDF04EF64D981BADB7B1FF44300F558169E856DB291EB31EA11CBA5

Function 00DB9EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a650f40c3f4b46da33f1e8abf05ef2a5663d191fbf66497ffbb24b4c5c91e5
Instruction ID: 05e001c9a260a196e8db69eb75ffdbeb3a257ac2312b8636774b50a034b7cda4
Opcode Fuzzy Hash: 63a650f40c3f4b46da33f1e8abf05ef2a5663d191fbf66497ffbb24b4c5c91e5
Instruction Fuzzy Hash: 91B1E120D2AF414DD323963A8831336B69CAFBB6D5F91D71BFC2774D22EB2686874540

Function 00DA1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: f42ab9c8d5774be3dc93c5ba17d354df1fbada83567cb378aa90124238df0a1e
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 6191677A1090A34ADB29463E857407EFFE15A933B1B1E079DE4F2CA1C5FE14CA58D630

Function 00DA19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 701915015d028f0a87665163d464f0b2ee26f2cdc7152f40d3d9e8d23583b543
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: D191447A2090A34EDB2D467A857403EFFE15A933A2B1E079DD4F2CA1C1FD24C559D630

Function 00DA7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f4ad244ac0bb8707d2212700bc1af6f34e30fe48b69a1fb773cd64b9266a00
Instruction ID: ac18d3dfefa2c43a82df82e18f4d6c65e8011a4f32a6528bcb6650f8e603e0e8
Opcode Fuzzy Hash: a2f4ad244ac0bb8707d2212700bc1af6f34e30fe48b69a1fb773cd64b9266a00
Instruction Fuzzy Hash: B06148B2708709A6DE349A288D95BBF2398DF43710F1C0D1AE887DB2C1DA11DE42D776

Function 00DA7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06958c2b8d7cf4afef50ef9e902119fc841e7de321d491d7b8127a889008edb8
Instruction ID: bc69a8a839644ca68c0a97f455c5c9b71f79b5b5dc9fda99c154d8dc7f6393e4
Opcode Fuzzy Hash: 06958c2b8d7cf4afef50ef9e902119fc841e7de321d491d7b8127a889008edb8
Instruction Fuzzy Hash: 44614A7160870AD6DE385A284C65BBF6394EF43704F1C0959F983DB2C1EA12EE429375

Function 00DA1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 528fe16fac0e6cddf83003e7e15c89bccc85e811da9e8e156d6264c5a454b6da
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 5C81767A6090A34DDB6D423A853443EFFE15A933A1B1E079DD4F2CB1C1EE24C958EA30

Function 00E02ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00E02B30
DeleteObject.GDI32(00000000), ref: 00E02B43
DestroyWindow.USER32 ref: 00E02B52
GetDesktopWindow.USER32 ref: 00E02B6D
GetWindowRect.USER32(00000000), ref: 00E02B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00E02CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00E02CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E02CF8
GetClientRect.USER32(00000000,?), ref: 00E02D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00E02D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E02D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E02D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E02D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E02D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E02D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E02DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E02DA8
GlobalFree.KERNEL32(00000000), ref: 00E02DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E02DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00E1FC38,00000000), ref: 00E02DDB
GlobalFree.KERNEL32(00000000), ref: 00E02DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00E02E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00E02E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E02E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E0303F

Strings

DISPLAY, xrefs: 00E02EA2
static, xrefs: 00E02D3A, 00E02E91
AutoIt v3, xrefs: 00E02CF2
, xrefs: 00E02FC5

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: b021fd67208a5ec0fcf0830819759814bf71ed73e38cbfeb098ded11bb7c8647
Instruction ID: 71faef63c5583bbcdd4cc30f446e98194afc0ba101ee9d5c016741d943b7db0b
Opcode Fuzzy Hash: b021fd67208a5ec0fcf0830819759814bf71ed73e38cbfeb098ded11bb7c8647
Instruction Fuzzy Hash: B0027871A00209AFDB14DFA5CC89EAE7BB9EB49710F108558F915FB2A1CB70ED45CB60

Function 00E170D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00E1712F
GetSysColorBrush.USER32(0000000F), ref: 00E17160
GetSysColor.USER32(0000000F), ref: 00E1716C
SetBkColor.GDI32(?,000000FF), ref: 00E17186
SelectObject.GDI32(?,?), ref: 00E17195
InflateRect.USER32(?,000000FF,000000FF), ref: 00E171C0
GetSysColor.USER32(00000010), ref: 00E171C8
CreateSolidBrush.GDI32(00000000), ref: 00E171CF
FrameRect.USER32(?,?,00000000), ref: 00E171DE
DeleteObject.GDI32(00000000), ref: 00E171E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00E17230
FillRect.USER32(?,?,?), ref: 00E17262
GetWindowLongW.USER32(?,000000F0), ref: 00E17284

Part of subcall function 00E173E8: GetSysColor.USER32(00000012), ref: 00E17421
Part of subcall function 00E173E8: SetTextColor.GDI32(?,?), ref: 00E17425
Part of subcall function 00E173E8: GetSysColorBrush.USER32(0000000F), ref: 00E1743B
Part of subcall function 00E173E8: GetSysColor.USER32(0000000F), ref: 00E17446
Part of subcall function 00E173E8: GetSysColor.USER32(00000011), ref: 00E17463
Part of subcall function 00E173E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E17471
Part of subcall function 00E173E8: SelectObject.GDI32(?,00000000), ref: 00E17482
Part of subcall function 00E173E8: SetBkColor.GDI32(?,00000000), ref: 00E1748B
Part of subcall function 00E173E8: SelectObject.GDI32(?,?), ref: 00E17498
Part of subcall function 00E173E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00E174B7
Part of subcall function 00E173E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E174CE
Part of subcall function 00E173E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00E174DB

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 198c9c237b26869dedfa838a320d45eb27e72e75b9f151d0bf090cd77a7e2297
Instruction ID: 543c4063107dc370b2f1555a52d220875f7686c98cb32b809ebdc08ca28ecb33
Opcode Fuzzy Hash: 198c9c237b26869dedfa838a320d45eb27e72e75b9f151d0bf090cd77a7e2297
Instruction Fuzzy Hash: 2BA1B172149301FFD7009F61DC48A9B7BBAFB48720F205A19F9A2E61E0D770E989CB51

Function 00D98D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00D98E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00DD6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00DD6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00DD6F43

Part of subcall function 00D98F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D98BE8,?,00000000,?,?,?,?,00D98BBA,00000000,?), ref: 00D98FC5

SendMessageW.USER32(?,00001053), ref: 00DD6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00DD6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00DD6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00DD6FB7

Strings

0, xrefs: 00DD6DCF

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: f6dc224bec8d16f6e347a01229b0499a82e1da32b4e330f834dd00d0ebe72b4b
Instruction ID: 392b690a7e3f428b7dc6d48caae923fd4214980b071ea3c757cdf503f8ff0b6c
Opcode Fuzzy Hash: f6dc224bec8d16f6e347a01229b0499a82e1da32b4e330f834dd00d0ebe72b4b
Instruction Fuzzy Hash: 3C129C30600211DFDB25CF28D854BAABBE5FF49701F28846AF495DB261CB32EC55DBA1

Function 00E02711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00E0273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00E0286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00E028A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00E028B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00E02900
GetClientRect.USER32(00000000,?), ref: 00E0290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00E02955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00E02964
GetStockObject.GDI32(00000011), ref: 00E02974
SelectObject.GDI32(00000000,00000000), ref: 00E02978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00E02988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E02991
DeleteDC.GDI32(00000000), ref: 00E0299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00E029C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00E029DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00E02A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00E02A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00E02A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00E02A77
GetStockObject.GDI32(00000011), ref: 00E02A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00E02A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00E02A97

Strings

DISPLAY, xrefs: 00E0295A
static, xrefs: 00E0294F, 00E02A71
AutoIt v3, xrefs: 00E028F8
msctls_progress32, xrefs: 00E02A13

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 65851f8a13a330939ae72691bdb701bc209429d1f01062faa871d8c6463f92ce
Instruction ID: c350be7a3ff5fe47b5023e1f26a88d2773e880ee89ad45e85a6c093144f2791b
Opcode Fuzzy Hash: 65851f8a13a330939ae72691bdb701bc209429d1f01062faa871d8c6463f92ce
Instruction Fuzzy Hash: 8BB16A71A40215AFEB14DFA9CC49FAE7BB9EB08711F108559FA14EB2D0D770AD44CBA0

Function 00DF4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00DF4AED
GetDriveTypeW.KERNEL32(?,00E1CB68,?,\\.\,00E1CC08), ref: 00DF4BCA
SetErrorMode.KERNEL32(00000000,00E1CB68,?,\\.\,00E1CC08), ref: 00DF4D36

Strings

iSCSI, xrefs: 00DF4CC2
Unknown, xrefs: 00DF4BED, 00DF4C83
FileBackedVirtual, xrefs: 00DF4CEC
SAS, xrefs: 00DF4CC9
CDROM, xrefs: 00DF4BFB
Virtual, xrefs: 00DF4CE5
ATA, xrefs: 00DF4C98
Network, xrefs: 00DF4C02
RAMDisk, xrefs: 00DF4BF4
RAID, xrefs: 00DF4CBB
SSA, xrefs: 00DF4CA6
PhysicalDrive, xrefs: 00DF4B76
1394, xrefs: 00DF4C9F
SATA, xrefs: 00DF4CD0
SCSI, xrefs: 00DF4C8A
SSD, xrefs: 00DF4C4A
MMC, xrefs: 00DF4CDE
Fixed, xrefs: 00DF4C09
Removable, xrefs: 00DF4C10, 00DF4C15
USB, xrefs: 00DF4CB4
\\.\, xrefs: 00DF4B3F
Fibre, xrefs: 00DF4CAD
ATAPI, xrefs: 00DF4C91

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 810c79332ac3f362bb7a2ce74f90f99a9a3c6caf12682544a22663c339018ae5
Instruction ID: e931fa3846f457bb02bce1c88ee482fccc7bc08156c00d46909e8bcfadcec612
Opcode Fuzzy Hash: 810c79332ac3f362bb7a2ce74f90f99a9a3c6caf12682544a22663c339018ae5
Instruction Fuzzy Hash: A461D33060124DABCB04EF24D98297EB7B0EF45710B2AE015F946BB252DB31ED41DB72

Function 00E173E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00E17421
SetTextColor.GDI32(?,?), ref: 00E17425
GetSysColorBrush.USER32(0000000F), ref: 00E1743B
GetSysColor.USER32(0000000F), ref: 00E17446
CreateSolidBrush.GDI32(?), ref: 00E1744B
GetSysColor.USER32(00000011), ref: 00E17463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E17471
SelectObject.GDI32(?,00000000), ref: 00E17482
SetBkColor.GDI32(?,00000000), ref: 00E1748B
SelectObject.GDI32(?,?), ref: 00E17498
InflateRect.USER32(?,000000FF,000000FF), ref: 00E174B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E174CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00E174DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00E1752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00E17554
InflateRect.USER32(?,000000FD,000000FD), ref: 00E17572
DrawFocusRect.USER32(?,?), ref: 00E1757D
GetSysColor.USER32(00000011), ref: 00E1758E
SetTextColor.GDI32(?,00000000), ref: 00E17596
DrawTextW.USER32(?,00E170F5,000000FF,?,00000000), ref: 00E175A8
SelectObject.GDI32(?,?), ref: 00E175BF
DeleteObject.GDI32(?), ref: 00E175CA
SelectObject.GDI32(?,?), ref: 00E175D0
DeleteObject.GDI32(?), ref: 00E175D5
SetTextColor.GDI32(?,?), ref: 00E175DB
SetBkColor.GDI32(?,?), ref: 00E175E5

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: b42c482991975d86a5e3d867f7325837b7fb7ed3d22aa1d7278bcb36b00ff9db
Instruction ID: c4cef4d5e18ee5243dabbc08b0e8c70ad3a0b6920e8263d53e846de2dc14954a
Opcode Fuzzy Hash: b42c482991975d86a5e3d867f7325837b7fb7ed3d22aa1d7278bcb36b00ff9db
Instruction Fuzzy Hash: FC615D72944218BFDF019FA5DC49AEE7FBAEB08720F218115F915FB2A1D7709980CB90

Function 00E10FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00E11128
GetDesktopWindow.USER32 ref: 00E1113D
GetWindowRect.USER32(00000000), ref: 00E11144
GetWindowLongW.USER32(?,000000F0), ref: 00E11199
DestroyWindow.USER32(?), ref: 00E111B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00E111ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E1120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00E1121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00E11232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00E11245
IsWindowVisible.USER32(00000000), ref: 00E112A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00E112BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00E112D0
GetWindowRect.USER32(00000000,?), ref: 00E112E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00E1130E
GetMonitorInfoW.USER32(00000000,?), ref: 00E11328
CopyRect.USER32(?,?), ref: 00E1133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00E113AA

Strings

tooltips_class32, xrefs: 00E111E6
(, xrefs: 00E1131B
0, xrefs: 00E110D3

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 0718bce365a0c363cb0d8a1191b6d2590472afeb07510f31bdb16edc7f23d1c2
Instruction ID: e9b6ab45c4061f01bb144c8c9add059aff5e28bf0ae15cc0ac5085d41f69813a
Opcode Fuzzy Hash: 0718bce365a0c363cb0d8a1191b6d2590472afeb07510f31bdb16edc7f23d1c2
Instruction Fuzzy Hash: 53B18F71604341AFD700DF65C884BAEFBE4FF84754F008959FA99AB2A1C771E884CB61

Function 00D98891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D98968
GetSystemMetrics.USER32(00000007), ref: 00D98970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D9899B
GetSystemMetrics.USER32(00000008), ref: 00D989A3
GetSystemMetrics.USER32(00000004), ref: 00D989C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00D989E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00D989F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00D98A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00D98A3C
GetClientRect.USER32(00000000,000000FF), ref: 00D98A5A
GetStockObject.GDI32(00000011), ref: 00D98A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00D98A81

Part of subcall function 00D9912D: GetCursorPos.USER32(?), ref: 00D99141
Part of subcall function 00D9912D: ScreenToClient.USER32(00000000,?), ref: 00D9915E
Part of subcall function 00D9912D: GetAsyncKeyState.USER32(00000001), ref: 00D99183
Part of subcall function 00D9912D: GetAsyncKeyState.USER32(00000002), ref: 00D9919D

SetTimer.USER32(00000000,00000000,00000028,00D990FC), ref: 00D98AA8

Strings

AutoIt v3 GUI, xrefs: 00D98A20

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 2baa880583d0a5d7ca3f2fa38142ca8ebf181cc84665bb574e4823d2aa27cf78
Instruction ID: 46be6f4712a82680598d66d97488316e082b9b379b62ffc1f74d8ca12a18f96d
Opcode Fuzzy Hash: 2baa880583d0a5d7ca3f2fa38142ca8ebf181cc84665bb574e4823d2aa27cf78
Instruction Fuzzy Hash: 25B16A71A40209AFDF14DFA9C845BAA3BB5FB48715F14422AFA15E7290DB74E844CB60

Function 00DE0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00DE1114
Part of subcall function 00DE10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00DE0B9B,?,?,?), ref: 00DE1120
Part of subcall function 00DE10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00DE0B9B,?,?,?), ref: 00DE112F
Part of subcall function 00DE10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00DE0B9B,?,?,?), ref: 00DE1136
Part of subcall function 00DE10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00DE114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00DE0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00DE0E29
GetLengthSid.ADVAPI32(?), ref: 00DE0E40
GetAce.ADVAPI32(?,00000000,?), ref: 00DE0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00DE0E96
GetLengthSid.ADVAPI32(?), ref: 00DE0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00DE0EB5
HeapAlloc.KERNEL32(00000000), ref: 00DE0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00DE0EDD
CopySid.ADVAPI32(00000000), ref: 00DE0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00DE0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00DE0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00DE0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DE0F6E
HeapFree.KERNEL32(00000000), ref: 00DE0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DE0F7E
HeapFree.KERNEL32(00000000), ref: 00DE0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DE0F8E
HeapFree.KERNEL32(00000000), ref: 00DE0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00DE0FA1
HeapFree.KERNEL32(00000000), ref: 00DE0FA8

Part of subcall function 00DE1193: GetProcessHeap.KERNEL32(00000008,00DE0BB1,?,00000000,?,00DE0BB1,?), ref: 00DE11A1
Part of subcall function 00DE1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00DE0BB1,?), ref: 00DE11A8
Part of subcall function 00DE1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00DE0BB1,?), ref: 00DE11B7

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: cc18c29d4df033171ed6cdc4363a623ebe1af91cf2a3bf8522908b6876b0f854
Instruction ID: e011722be93d14173b77ea48483578db5e18cbd2656506023fec3cb280a061df
Opcode Fuzzy Hash: cc18c29d4df033171ed6cdc4363a623ebe1af91cf2a3bf8522908b6876b0f854
Instruction Fuzzy Hash: 4B719C7290424AAFDB20AFA6DC44BEEBBB8BF08300F188115F958F6190D7709D59CB70

Function 00E0C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E0C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00E1CC08,00000000,?,00000000,?,?), ref: 00E0C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00E0C5A4
_wcslen.LIBCMT ref: 00E0C5F4
_wcslen.LIBCMT ref: 00E0C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00E0C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00E0C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00E0C84D
RegCloseKey.ADVAPI32(?), ref: 00E0C881
RegCloseKey.ADVAPI32(00000000), ref: 00E0C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00E0C960

Strings

REG_SZ, xrefs: 00E0C644
REG_EXPAND_SZ, xrefs: 00E0C5CD
REG_DWORD, xrefs: 00E0C804
REG_QWORD, xrefs: 00E0C8C3
REG_MULTI_SZ, xrefs: 00E0C6F5
REG_BINARY, xrefs: 00E0C913

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 85637dbe58b5cacddb15b9e804cdaaa755d3fa44b96037eab869f272a482297d
Instruction ID: b0072de888420f25216a241e36ceb7ed0074a3bebebe3846c55303095e932da3
Opcode Fuzzy Hash: 85637dbe58b5cacddb15b9e804cdaaa755d3fa44b96037eab869f272a482297d
Instruction Fuzzy Hash: 2C127F356042019FD714EF14C881A2AB7E5FF88714F24899DF85AAB3A2DB31FD41CBA1

Function 00E1091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00E109C6
_wcslen.LIBCMT ref: 00E10A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E10A54
_wcslen.LIBCMT ref: 00E10A8A
_wcslen.LIBCMT ref: 00E10B06
_wcslen.LIBCMT ref: 00E10B81

Part of subcall function 00D9F9F2: _wcslen.LIBCMT ref: 00D9F9FD

Part of subcall function 00DE2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00DE2BFA

Strings

UNCHECK, xrefs: 00E10D3E
CHECK, xrefs: 00E10A85, 00E10AA0
EXPAND, xrefs: 00E10BF8
EXISTS, xrefs: 00E10B7C, 00E10B97
GETITEMCOUNT, xrefs: 00E10C1E
GETTOTALCOUNT, xrefs: 00E109F2, 00E10A17
GETTEXT, xrefs: 00E10C97
GETSELECTED, xrefs: 00E10C4E
ISCHECKED, xrefs: 00E10CE1
SELECT, xrefs: 00E10D11
COLLAPSE, xrefs: 00E10B01, 00E10B1C

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 93a7d9444f92a66678200ca2f663b97c6e17c33211f2ccfe3341b0dcb0e7c335
Instruction ID: 86cb47eb0a8278ca9669488b15917cbc45fc849209aed18e29af4491b326f5f6
Opcode Fuzzy Hash: 93a7d9444f92a66678200ca2f663b97c6e17c33211f2ccfe3341b0dcb0e7c335
Instruction Fuzzy Hash: AEE1AC312083019FCB14EF24C4519AAB7E1FFD8318B54995DF896AB3A2D770ED85CBA1

Function 00E0C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E0B6AE,?,?), ref: 00E0C9B5
_wcslen.LIBCMT ref: 00E0C9F1
_wcslen.LIBCMT ref: 00E0CA68
_wcslen.LIBCMT ref: 00E0CA9E
_wcslen.LIBCMT ref: 00E0CAF9
_wcslen.LIBCMT ref: 00E0CB2F
_wcslen.LIBCMT ref: 00E0CB7F

Strings

HKEY_USERS, xrefs: 00E0CBDF
HKEY_CURRENT_USER, xrefs: 00E0CBBD
HKLM, xrefs: 00E0CA98, 00E0CA9D
HKEY_CURRENT_CONFIG, xrefs: 00E0CB79, 00E0CB7E
HKCR, xrefs: 00E0CB29, 00E0CB2E
HKEY_LOCAL_MACHINE, xrefs: 00E0CA62, 00E0CA67
HKU, xrefs: 00E0CBF0
HKCU, xrefs: 00E0CBCE
HKCC, xrefs: 00E0CBAC
HKEY_CLASSES_ROOT, xrefs: 00E0CAF3, 00E0CAF8

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 253ea55cd603f0c82bf3ec6adef607596eaf4032d283121e532b6937e1745202
Instruction ID: 08053724506788573d3d0efb042c3deb59d2126d27b7ad65389058873dfbb654
Opcode Fuzzy Hash: 253ea55cd603f0c82bf3ec6adef607596eaf4032d283121e532b6937e1745202
Instruction Fuzzy Hash: E471E23260016A8BCB20DF68C8515BE73A5ABA1758B752B29FC56B72C4E630CDC4C7A0

Function 00E1833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E1835A
_wcslen.LIBCMT ref: 00E1836E
_wcslen.LIBCMT ref: 00E18391
_wcslen.LIBCMT ref: 00E183B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00E183F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00E1361A,?), ref: 00E1844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E18487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00E184CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E18501
FreeLibrary.KERNEL32(?), ref: 00E1850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00E1851D
DestroyIcon.USER32(?), ref: 00E1852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00E18549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00E18555

Strings

.exe, xrefs: 00E18388
.dll, xrefs: 00E183AB
.icl, xrefs: 00E18368

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 94f8f54f997b57b24f81d55097cb698f11d3c2986126b4205f651bc07234aa38
Instruction ID: b29877893c3a9aec339869e21ab83a4a4ab7e88d1ae546d2b8eab549c50a5a6a
Opcode Fuzzy Hash: 94f8f54f997b57b24f81d55097cb698f11d3c2986126b4205f651bc07234aa38
Instruction Fuzzy Hash: FD61BD71540215BEEB149F64CD41BFE77A9FB04B21F209609F825E60D1DFB4AA94CBA0

Function 00D87778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#OnAutoItStartRegister, xrefs: 00D87817
Cannot parse #include, xrefs: 00DC5279
#notrayicon, xrefs: 00D877E7
", xrefs: 00DC5153
#requireadmin, xrefs: 00D877FF
Bad directive syntax error, xrefs: 00DC519A
#pragma compile, xrefs: 00D877D3
#cs, xrefs: 00D87873, 00D878C5
#include-once, xrefs: 00D8782F
#include, xrefs: 00D87847
Unterminated group of comments, xrefs: 00DC528C
', xrefs: 00DC5169
#ce, xrefs: 00D878ED
#comments-start, xrefs: 00D8785F, 00D878B1
#comments-end, xrefs: 00D878D9

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: adddfbd588fba8af843ee23503f9df4cde9d6e66ac1606b4382616e8b3549592
Instruction ID: 4a7d680e24ec989d5a456ed44e77d9435533d388bf026aa739fc61aeaaa00baa
Opcode Fuzzy Hash: adddfbd588fba8af843ee23503f9df4cde9d6e66ac1606b4382616e8b3549592
Instruction Fuzzy Hash: 0781B271A44706BBDB21BF60DC42FAEB7A8EF15300F184024F805AB19AEB71DA51D7B1

Function 00DF3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00DF3EF8
_wcslen.LIBCMT ref: 00DF3F03
_wcslen.LIBCMT ref: 00DF3F5A
_wcslen.LIBCMT ref: 00DF3F98
GetDriveTypeW.KERNEL32(?), ref: 00DF3FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DF401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DF4059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DF4087

Strings

open, xrefs: 00DF3F54, 00DF3F59
wait, xrefs: 00DF4044
type cdaudio alias cd wait, xrefs: 00DF4001
open , xrefs: 00DF3FE5
close, xrefs: 00DF3EFE, 00DF3F18
closed, xrefs: 00DF3F08, 00DF3F2D, 00DF3F46, 00DF3F7E, 00DF3F97
close cd wait, xrefs: 00DF4072
set cd door , xrefs: 00DF4028

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 11714dca5d460a80fbaa36c7aef37360b937970793454e25a3aa5a93336c5e30
Instruction ID: 50cf18c8c7e7a7c0fb4c0aa4ad34be0fcceddd459f02efae9933e9272f577790
Opcode Fuzzy Hash: 11714dca5d460a80fbaa36c7aef37360b937970793454e25a3aa5a93336c5e30
Instruction Fuzzy Hash: 9571AC316042069FC310EF24C88187AB7F4EF95768B15892DFA95A7251EB30EE45CB72

Function 00DE5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00DE5A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00DE5A40
SetWindowTextW.USER32(?,?), ref: 00DE5A57
GetDlgItem.USER32(?,000003EA), ref: 00DE5A6C
SetWindowTextW.USER32(00000000,?), ref: 00DE5A72
GetDlgItem.USER32(?,000003E9), ref: 00DE5A82
SetWindowTextW.USER32(00000000,?), ref: 00DE5A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00DE5AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00DE5AC3
GetWindowRect.USER32(?,?), ref: 00DE5ACC
_wcslen.LIBCMT ref: 00DE5B33
SetWindowTextW.USER32(?,?), ref: 00DE5B6F
GetDesktopWindow.USER32 ref: 00DE5B75
GetWindowRect.USER32(00000000), ref: 00DE5B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00DE5BD3
GetClientRect.USER32(?,?), ref: 00DE5BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00DE5C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00DE5C2F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 6944ec5cd33ad7adbecb881a4fc4cfb8e4b3e73a61bd324fa327e24a32e3ae26
Instruction ID: 7a046984c4b43673ce04b1ee0a7e32a765a64c0a73398004c0fc104b5b7954ab
Opcode Fuzzy Hash: 6944ec5cd33ad7adbecb881a4fc4cfb8e4b3e73a61bd324fa327e24a32e3ae26
Instruction Fuzzy Hash: 25719F31900B459FCB20EFAADE45BAEBBF5FF48748F144518E142A21A4D771E904CB60

Function 00DFFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00DFFE27
LoadCursorW.USER32(00000000,00007F8A), ref: 00DFFE32
LoadCursorW.USER32(00000000,00007F00), ref: 00DFFE3D
LoadCursorW.USER32(00000000,00007F03), ref: 00DFFE48
LoadCursorW.USER32(00000000,00007F8B), ref: 00DFFE53
LoadCursorW.USER32(00000000,00007F01), ref: 00DFFE5E
LoadCursorW.USER32(00000000,00007F81), ref: 00DFFE69
LoadCursorW.USER32(00000000,00007F88), ref: 00DFFE74
LoadCursorW.USER32(00000000,00007F80), ref: 00DFFE7F
LoadCursorW.USER32(00000000,00007F86), ref: 00DFFE8A
LoadCursorW.USER32(00000000,00007F83), ref: 00DFFE95
LoadCursorW.USER32(00000000,00007F85), ref: 00DFFEA0
LoadCursorW.USER32(00000000,00007F82), ref: 00DFFEAB
LoadCursorW.USER32(00000000,00007F84), ref: 00DFFEB6
LoadCursorW.USER32(00000000,00007F04), ref: 00DFFEC1
LoadCursorW.USER32(00000000,00007F02), ref: 00DFFECC
GetCursorInfo.USER32(?), ref: 00DFFEDC
GetLastError.KERNEL32 ref: 00DFFF1E

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: b251a5859bd58684ce42763aa5cf840565f195c6abae1c15f4a4615d07a46d42
Instruction ID: 106ce7ad47f399f9aad7e819bad184fe751c805130688a8f9d1bb702ecf22746
Opcode Fuzzy Hash: b251a5859bd58684ce42763aa5cf840565f195c6abae1c15f4a4615d07a46d42
Instruction Fuzzy Hash: 384174B0D04319AEDB109FBA8C8586EBFE8FF04754B54852AE11DE7281DB78D905CFA1

Function 00DE30F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DE318D
_wcslen.LIBCMT ref: 00DE31F8

Strings

INSTANCE, xrefs: 00DE3453
CLASS, xrefs: 00DE3188, 00DE31A5
TEXT, xrefs: 00DE347C
[, xrefs: 00DE339A
NAME, xrefs: 00DE3335, 00DE3346
REGEXPCLASS, xrefs: 00DE3255, 00DE3266
CLASSNN, xrefs: 00DE31F3, 00DE3204

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[
API String ID: 176396367-1901692981
Opcode ID: dabbe201e36d430ff2e88987d34f34da72fc6966470554dd0a5b345029e8e480
Instruction ID: 18f442a620bc11fa6e22c400ad48dc6d5c3f8544066bcaf3f96952f151732216
Opcode Fuzzy Hash: dabbe201e36d430ff2e88987d34f34da72fc6966470554dd0a5b345029e8e480
Instruction Fuzzy Hash: ABE1B632A00656ABCB18EF69C459AFEF7B4FF54710F588129E456F7240DB30AE458BB0

Function 00DA00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00DA00C6

Part of subcall function 00DA00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00E5070C,00000FA0,3A542A66,?,?,?,?,00DC23B3,000000FF), ref: 00DA011C
Part of subcall function 00DA00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00DC23B3,000000FF), ref: 00DA0127
Part of subcall function 00DA00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00DC23B3,000000FF), ref: 00DA0138
Part of subcall function 00DA00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00DA014E
Part of subcall function 00DA00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00DA015C
Part of subcall function 00DA00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00DA016A
Part of subcall function 00DA00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00DA0195
Part of subcall function 00DA00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00DA01A0

___scrt_fastfail.LIBCMT ref: 00DA00E7

Part of subcall function 00DA00A3: __onexit.LIBCMT ref: 00DA00A9

Strings

SleepConditionVariableCS, xrefs: 00DA0154
WakeAllConditionVariable, xrefs: 00DA0162
kernel32.dll, xrefs: 00DA0133
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00DA0122
InitializeConditionVariable, xrefs: 00DA0148

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: c5eddfface0ddee01c411135cbda1d6565145fa6aab88f23ac3711a902926cd7
Instruction ID: cc101acfae35eb730e232d28401ac9a0c1e7a7b2ead7c8e4c04f5b632a917dd7
Opcode Fuzzy Hash: c5eddfface0ddee01c411135cbda1d6565145fa6aab88f23ac3711a902926cd7
Instruction Fuzzy Hash: 7D21F632B857116FE7106F65AC06BEA3BA4EB06B61F14452AFD01F3291DBA498048AB0

Function 00DF44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00E1CC08), ref: 00DF4527
_wcslen.LIBCMT ref: 00DF453B
_wcslen.LIBCMT ref: 00DF4599
_wcslen.LIBCMT ref: 00DF45F4
_wcslen.LIBCMT ref: 00DF463F
_wcslen.LIBCMT ref: 00DF46A7

Part of subcall function 00D9F9F2: _wcslen.LIBCMT ref: 00D9F9FD

GetDriveTypeW.KERNEL32(?,00E46BF0,00000061), ref: 00DF4743

Strings

cdrom, xrefs: 00DF458F, 00DF4594
unknown, xrefs: 00DF4708
network, xrefs: 00DF469D, 00DF46A2
ramdisk, xrefs: 00DF46F1
removable, xrefs: 00DF45EA, 00DF45EF
all, xrefs: 00DF4531, 00DF4536
fixed, xrefs: 00DF4635, 00DF463A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 29c89c1070818f910690f6023266c33831a2004b3044cda4da92047497d38ae3
Instruction ID: bea04001bef127a25e3d5672485ff42bd13569ed0555de3d006bb71a3a543fea
Opcode Fuzzy Hash: 29c89c1070818f910690f6023266c33831a2004b3044cda4da92047497d38ae3
Instruction Fuzzy Hash: ABB1FF316083029BC710EF28D890A7BB7E5EFA6720F59891DF696D7291D730D944CBB2

Function 00E1911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D99BB2

DragQueryPoint.SHELL32(?,?), ref: 00E19147

Part of subcall function 00E17674: ClientToScreen.USER32(?,?), ref: 00E1769A
Part of subcall function 00E17674: GetWindowRect.USER32(?,?), ref: 00E17710
Part of subcall function 00E17674: PtInRect.USER32(?,?,00E18B89), ref: 00E17720

SendMessageW.USER32(?,000000B0,?,?), ref: 00E191B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00E191BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00E191DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00E19225
SendMessageW.USER32(?,000000B0,?,?), ref: 00E1923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00E19255
SendMessageW.USER32(?,000000B1,?,?), ref: 00E19277
DragFinish.SHELL32(?), ref: 00E1927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00E19371

Strings

@GUI_DRAGFILE, xrefs: 00E19320
@GUI_DROPID, xrefs: 00E1929E
@GUI_DRAGID, xrefs: 00E192E9
p#, xrefs: 00E192BB

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#
API String ID: 221274066-136824727
Opcode ID: 8dcf42f55269e8c95b67b21f948eb7d0cb75195ac018386d6edfc10364b78190
Instruction ID: d5a7f8dd39a824263f833bb6c92d4d1209a4c520cc7f44b379c385228aad50fc
Opcode Fuzzy Hash: 8dcf42f55269e8c95b67b21f948eb7d0cb75195ac018386d6edfc10364b78190
Instruction Fuzzy Hash: 45618C71108301AFD701EF65DC95DAFBBE8EF88750F10091EF5A6A21A1DB309A48CB62

Function 00E03FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00E1CC08), ref: 00E040BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00E040CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00E1CC08), ref: 00E040F2
FreeLibrary.KERNEL32(00000000,?,00E1CC08), ref: 00E0413E
StringFromGUID2.OLE32(?,?,00000028,?,00E1CC08), ref: 00E041A8
SysFreeString.OLEAUT32(00000009), ref: 00E04262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00E042C8
SysFreeString.OLEAUT32(?), ref: 00E042F2

Strings

kernel32.dll, xrefs: 00E040B6
GetModuleHandleExW, xrefs: 00E040C7

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: 0999527112a248318d54d98b5ea4900f413c87f0dd184f5f6f3b6e7a1da5df9c
Instruction ID: 23bf1c26d2c872830bd424ddb4eb66189a36e01c39fecee1db44bd846f01ec80
Opcode Fuzzy Hash: 0999527112a248318d54d98b5ea4900f413c87f0dd184f5f6f3b6e7a1da5df9c
Instruction Fuzzy Hash: FC125EF1A00115EFDB14DF94C984EAEB7B5FF45318F249098EA15AB291C731ED86CBA0

Function 00D8326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00E51990), ref: 00DC2F8D
GetMenuItemCount.USER32(00E51990), ref: 00DC303D
GetCursorPos.USER32(?), ref: 00DC3081
SetForegroundWindow.USER32(00000000), ref: 00DC308A
TrackPopupMenuEx.USER32(00E51990,00000000,?,00000000,00000000,00000000), ref: 00DC309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00DC30A9

Strings

0, xrefs: 00D8327D

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 0435f5604aeb0e9fcd386780bbee25b65fbaed7b0fab9610efe7c63dde70cbae
Instruction ID: 8f8b56faa9d31e1042d136c5311daf1b718b5cdb1bd5dd19bf530c2cf9386d50
Opcode Fuzzy Hash: 0435f5604aeb0e9fcd386780bbee25b65fbaed7b0fab9610efe7c63dde70cbae
Instruction Fuzzy Hash: B8713C71644206BEEB219F29CC49FAABF65FF01764F24421AF518A71D0C7B1AD14DB70

Function 00E16CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00E16DEB

Part of subcall function 00D86B57: _wcslen.LIBCMT ref: 00D86B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00E16E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00E16E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E16E94
DestroyWindow.USER32(?), ref: 00E16EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00D80000,00000000), ref: 00E16EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E16EFD
GetDesktopWindow.USER32 ref: 00E16F16
GetWindowRect.USER32(00000000), ref: 00E16F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00E16F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00E16F4D

Part of subcall function 00D99944: GetWindowLongW.USER32(?,000000EB), ref: 00D99952

Strings

0, xrefs: 00E16D98
tooltips_class32, xrefs: 00E16E58, 00E16EDD

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 6aa317da9b23fe22e423ce8f1dfc4e1894f7598ab5a7519c414af67935036bbc
Instruction ID: e325c102c617dd540c23e3cfe487b5d3425fbb6ad342dc5988982a4494efa5cd
Opcode Fuzzy Hash: 6aa317da9b23fe22e423ce8f1dfc4e1894f7598ab5a7519c414af67935036bbc
Instruction Fuzzy Hash: 54718CB0244340AFDB21CF19DC44FAABBE9FB89708F14591DF599A7260C770E94ACB12

Function 00DFC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00DFC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00DFC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00DFC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00DFC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00DFC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00DFC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DFC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00DFC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00DFC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00DFC5F0
InternetCloseHandle.WININET(00000000), ref: 00DFC5FB

Strings

, xrefs: 00DFC575

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 688c23f25d99d98f19d207d875532306f6c42e6c76d7d6abab91fc5744fca968
Instruction ID: 8994e907bd200a6503363964c78529baff333dba166c75771053feed8ce11997
Opcode Fuzzy Hash: 688c23f25d99d98f19d207d875532306f6c42e6c76d7d6abab91fc5744fca968
Instruction Fuzzy Hash: F5517BB055020CBFDB218F61CA48ABA7BBCEF08744F15941AFA45D6250DB30E958DB70

Function 00E1856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00E18592
GetFileSize.KERNEL32(00000000,00000000), ref: 00E185A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00E185AD
CloseHandle.KERNEL32(00000000), ref: 00E185BA
GlobalLock.KERNEL32(00000000), ref: 00E185C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00E185D7
GlobalUnlock.KERNEL32(00000000), ref: 00E185E0
CloseHandle.KERNEL32(00000000), ref: 00E185E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00E185F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,00E1FC38,?), ref: 00E18611
GlobalFree.KERNEL32(00000000), ref: 00E18621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00E18641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00E18671
DeleteObject.GDI32(00000000), ref: 00E18699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00E186AF

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: db3587c69e408c2758447514877f3c1d64989a53a12524f8afcb7820b403bce2
Instruction ID: fc14599984b156840e43d2f6e7af7ec68352630c4726fb25fdbd638cf891f969
Opcode Fuzzy Hash: db3587c69e408c2758447514877f3c1d64989a53a12524f8afcb7820b403bce2
Instruction Fuzzy Hash: 6E413971640204AFDB118FA6CD48EEA7BB9EF89B15F208058F915E7260DB309945CB60

Function 00DF14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00DF1502
VariantCopy.OLEAUT32(?,?), ref: 00DF150B
VariantClear.OLEAUT32(?), ref: 00DF1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00DF15FB
VarR8FromDec.OLEAUT32(?,?), ref: 00DF1657
VariantInit.OLEAUT32(?), ref: 00DF1708
SysFreeString.OLEAUT32(?), ref: 00DF178C
VariantClear.OLEAUT32(?), ref: 00DF17D8
VariantClear.OLEAUT32(?), ref: 00DF17E7
VariantInit.OLEAUT32(00000000), ref: 00DF1823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00DF1625
Default, xrefs: 00DF16AF

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 7743d6979fbd332f4eac2edb74393c68576afff74b705d3acf78960e545fc942
Instruction ID: 50efa81f4c45f29a4f9c4acf2f2419c26c1c38e0e884d35dcb86419d5c968b1f
Opcode Fuzzy Hash: 7743d6979fbd332f4eac2edb74393c68576afff74b705d3acf78960e545fc942
Instruction Fuzzy Hash: 52D1F235A04219DBDB04AF65D884B7DB7B6FF44700F26C456E686AB280DB30DC84DBB1

Function 00E0B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

Part of subcall function 00E0C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E0B6AE,?,?), ref: 00E0C9B5
Part of subcall function 00E0C998: _wcslen.LIBCMT ref: 00E0C9F1
Part of subcall function 00E0C998: _wcslen.LIBCMT ref: 00E0CA68
Part of subcall function 00E0C998: _wcslen.LIBCMT ref: 00E0CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E0B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E0B772
RegDeleteValueW.ADVAPI32(?,?), ref: 00E0B80A
RegCloseKey.ADVAPI32(?), ref: 00E0B87E
RegCloseKey.ADVAPI32(?), ref: 00E0B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00E0B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00E0B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00E0B922
FreeLibrary.KERNEL32(00000000), ref: 00E0B983
RegCloseKey.ADVAPI32(00000000), ref: 00E0B994

Strings

RegDeleteKeyExW, xrefs: 00E0B8FE
advapi32.dll, xrefs: 00E0B8ED

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 487a529711f1f495c0a8d8a397d9009b4d862a8216d6a1801243fc3609175379
Instruction ID: 921cf6821d54f5bca754e2acd89f1af286d7a1185d1c2df1432238b813554c23
Opcode Fuzzy Hash: 487a529711f1f495c0a8d8a397d9009b4d862a8216d6a1801243fc3609175379
Instruction Fuzzy Hash: 8EC17D30208201AFD714DF14C495F2ABBE5FF84318F58955CF59AAB2A2CB71ED85CBA1

Function 00E0255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00E025D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00E025E8
CreateCompatibleDC.GDI32(?), ref: 00E025F4
SelectObject.GDI32(00000000,?), ref: 00E02601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00E0266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00E026AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00E026D0
SelectObject.GDI32(?,?), ref: 00E026D8
DeleteObject.GDI32(?), ref: 00E026E1
DeleteDC.GDI32(?), ref: 00E026E8
ReleaseDC.USER32(00000000,?), ref: 00E026F3

Strings

(, xrefs: 00E0268D

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 6b8ced3626be9a5942266c5f6f9c326a7e7a3ebdc3d03d09691dd81ba431643d
Instruction ID: f0b9da2cc91944a30751ade1457f0b349a4d7a668ab582affb71ab823eacd0ee
Opcode Fuzzy Hash: 6b8ced3626be9a5942266c5f6f9c326a7e7a3ebdc3d03d09691dd81ba431643d
Instruction Fuzzy Hash: EC61C175D00219EFCF04CFA4D884AAEBBF5FF48310F248529EA55B7250D771A9518FA0

Function 00DBDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00DBDAA1

Part of subcall function 00DBD63C: _free.LIBCMT ref: 00DBD659
Part of subcall function 00DBD63C: _free.LIBCMT ref: 00DBD66B
Part of subcall function 00DBD63C: _free.LIBCMT ref: 00DBD67D
Part of subcall function 00DBD63C: _free.LIBCMT ref: 00DBD68F
Part of subcall function 00DBD63C: _free.LIBCMT ref: 00DBD6A1
Part of subcall function 00DBD63C: _free.LIBCMT ref: 00DBD6B3
Part of subcall function 00DBD63C: _free.LIBCMT ref: 00DBD6C5
Part of subcall function 00DBD63C: _free.LIBCMT ref: 00DBD6D7
Part of subcall function 00DBD63C: _free.LIBCMT ref: 00DBD6E9
Part of subcall function 00DBD63C: _free.LIBCMT ref: 00DBD6FB
Part of subcall function 00DBD63C: _free.LIBCMT ref: 00DBD70D
Part of subcall function 00DBD63C: _free.LIBCMT ref: 00DBD71F
Part of subcall function 00DBD63C: _free.LIBCMT ref: 00DBD731

_free.LIBCMT ref: 00DBDA96

Part of subcall function 00DB29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00DBD7D1,00000000,00000000,00000000,00000000,?,00DBD7F8,00000000,00000007,00000000,?,00DBDBF5,00000000), ref: 00DB29DE
Part of subcall function 00DB29C8: GetLastError.KERNEL32(00000000,?,00DBD7D1,00000000,00000000,00000000,00000000,?,00DBD7F8,00000000,00000007,00000000,?,00DBDBF5,00000000,00000000), ref: 00DB29F0

_free.LIBCMT ref: 00DBDAB8
_free.LIBCMT ref: 00DBDACD
_free.LIBCMT ref: 00DBDAD8
_free.LIBCMT ref: 00DBDAFA
_free.LIBCMT ref: 00DBDB0D
_free.LIBCMT ref: 00DBDB1B
_free.LIBCMT ref: 00DBDB26
_free.LIBCMT ref: 00DBDB5E
_free.LIBCMT ref: 00DBDB65
_free.LIBCMT ref: 00DBDB82
_free.LIBCMT ref: 00DBDB9A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: dfacd211f286fffc54cb3ccf13e010cd3b2e9dc8b78c5751c16045e4d7d78be9
Instruction ID: 7d20d72ce64d0a062366543fb4dabda03879714e73a43bfd4c7fd19c8148355f
Opcode Fuzzy Hash: dfacd211f286fffc54cb3ccf13e010cd3b2e9dc8b78c5751c16045e4d7d78be9
Instruction Fuzzy Hash: 46311F32644705EFDF25AA39E845BEAB7EAFF10311F194819E45AD7191EF31AC408B34

Function 00DE365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00DE369C
_wcslen.LIBCMT ref: 00DE36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00DE3797
GetClassNameW.USER32(?,?,00000400), ref: 00DE380C
GetDlgCtrlID.USER32(?), ref: 00DE385D
GetWindowRect.USER32(?,?), ref: 00DE3882
GetParent.USER32(?), ref: 00DE38A0
ScreenToClient.USER32(00000000), ref: 00DE38A7
GetClassNameW.USER32(?,?,00000100), ref: 00DE3921
GetWindowTextW.USER32(?,?,00000400), ref: 00DE395D

Strings

%s%u, xrefs: 00DE3734

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: de4a340e242792c2d16980f6857e05dae321ee453ac509bd68e141385b6a532a
Instruction ID: b99286b9ef892ddf88be826ac22819d9861952f43054b32f9f34b2845a8d475a
Opcode Fuzzy Hash: de4a340e242792c2d16980f6857e05dae321ee453ac509bd68e141385b6a532a
Instruction Fuzzy Hash: 5991A071204746AFD718EF26C889BBAB7A8FF44310F048529F999D3191DB30EA45CBB1

Function 00DE4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00DE4994
GetWindowTextW.USER32(?,?,00000400), ref: 00DE49DA
_wcslen.LIBCMT ref: 00DE49EB
CharUpperBuffW.USER32(?,00000000), ref: 00DE49F7
_wcsstr.LIBVCRUNTIME ref: 00DE4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00DE4A64
GetWindowTextW.USER32(?,?,00000400), ref: 00DE4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00DE4AE6
GetClassNameW.USER32(?,?,00000400), ref: 00DE4B20
GetWindowRect.USER32(?,?), ref: 00DE4B8B

Strings

ThumbnailClass, xrefs: 00DE4A6F, 00DE4AF1

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: ac97ff34048eae9c025b0ab3b65bdeb897e8ca90c30673a82f69677994ba1a0a
Instruction ID: f6ea9adbabdb10da3a39af507dbd41c107efce1cbc468013e5b8549c0fe55509
Opcode Fuzzy Hash: ac97ff34048eae9c025b0ab3b65bdeb897e8ca90c30673a82f69677994ba1a0a
Instruction Fuzzy Hash: A891CC710043459FDB04EF16C985BAAB7E8FF84714F088469FD859A096EB34ED45CBB1

Function 00E0CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00E0CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00E0CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00E0CD48

Part of subcall function 00E0CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00E0CCAA
Part of subcall function 00E0CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00E0CCBD
Part of subcall function 00E0CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00E0CCCF
Part of subcall function 00E0CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00E0CD05
Part of subcall function 00E0CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00E0CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00E0CCF3

Strings

RegDeleteKeyExW, xrefs: 00E0CCC9
advapi32.dll, xrefs: 00E0CCB8

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: b4f1323af0657276f6606e9680cc27539dca164eef653d45e9b46dda0086c11a
Instruction ID: 0e8f4911984d5c896a37f205451845893fd377310c05486f9ce07acf6de845be
Opcode Fuzzy Hash: b4f1323af0657276f6606e9680cc27539dca164eef653d45e9b46dda0086c11a
Instruction Fuzzy Hash: 4F318071A41128BFD7208F51DC88EFFBB7CEF45744F204265A906F2180D7309E89DAA0

Function 00DF3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00DF3D40
_wcslen.LIBCMT ref: 00DF3D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00DF3D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00DF3DBE
RemoveDirectoryW.KERNEL32(?), ref: 00DF3DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00DF3E55
CloseHandle.KERNEL32(00000000), ref: 00DF3E60
CloseHandle.KERNEL32(00000000), ref: 00DF3E6B

Strings

:, xrefs: 00DF3D82
\??\%s, xrefs: 00DF3D5B
\, xrefs: 00DF3D77

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: a1b70dc16c81e7aff87a4da947d0cd9316ea9b1827dac7b77cb4e6bebd35ac4c
Instruction ID: 1dee81afed4c8bfbc9ef5b1ad3891e4a6ee629094d41c6a673b9b4da5ef953cb
Opcode Fuzzy Hash: a1b70dc16c81e7aff87a4da947d0cd9316ea9b1827dac7b77cb4e6bebd35ac4c
Instruction Fuzzy Hash: A0319072940219ABDB209FA1DC49FEF37BDEF89740F2181A5F615E6060EB7097448B34

Function 00DEE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00DEE6B4

Part of subcall function 00D9E551: timeGetTime.WINMM(?,?,00DEE6D4), ref: 00D9E555

Sleep.KERNEL32(0000000A), ref: 00DEE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00DEE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00DEE727
SetActiveWindow.USER32 ref: 00DEE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00DEE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00DEE773
Sleep.KERNEL32(000000FA), ref: 00DEE77E
IsWindow.USER32 ref: 00DEE78A
EndDialog.USER32(00000000), ref: 00DEE79B

Strings

BUTTON, xrefs: 00DEE719

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 0b3b7bc618174604baf145b22fdf0fc3596ed5774826adb67f48b85357dd22ed
Instruction ID: 153481763374c5b292bcdd59237f4caef4397290ffaf766eb3f660df3c916b7b
Opcode Fuzzy Hash: 0b3b7bc618174604baf145b22fdf0fc3596ed5774826adb67f48b85357dd22ed
Instruction Fuzzy Hash: 1D21C3B0240781AFEB047F23EC89B653B69F75574AF244C29F605E21A1DBB1AC0C9A35

Function 00DEE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00DEEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00DEEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DEEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00DEEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00DEEAA7

Strings

close PlayMe, xrefs: 00DEEA6E, 00DEEA9B
status PlayMe mode, xrefs: 00DEEA58
play PlayMe wait, xrefs: 00DEEA91
open , xrefs: 00DEEA0C
play PlayMe, xrefs: 00DEEAA2
alias PlayMe, xrefs: 00DEEA36

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: bf00f94a8af69856fb17132166f88b3c28a4d72350e6fbf61d2326bb70ecee83
Instruction ID: b6fb347ad6d871c3b0459fc1e27d6f71d2637bf39801f8bc532e7099bff064a5
Opcode Fuzzy Hash: bf00f94a8af69856fb17132166f88b3c28a4d72350e6fbf61d2326bb70ecee83
Instruction Fuzzy Hash: 6B115131A9036979D720B7A7EC4ADFF6B7CEBD2B04F041429B505B20D1EEB05A05C6B1

Function 00DE9F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00DEA012
SetKeyboardState.USER32(?), ref: 00DEA07D
GetAsyncKeyState.USER32(000000A0), ref: 00DEA09D
GetKeyState.USER32(000000A0), ref: 00DEA0B4
GetAsyncKeyState.USER32(000000A1), ref: 00DEA0E3
GetKeyState.USER32(000000A1), ref: 00DEA0F4
GetAsyncKeyState.USER32(00000011), ref: 00DEA120
GetKeyState.USER32(00000011), ref: 00DEA12E
GetAsyncKeyState.USER32(00000012), ref: 00DEA157
GetKeyState.USER32(00000012), ref: 00DEA165
GetAsyncKeyState.USER32(0000005B), ref: 00DEA18E
GetKeyState.USER32(0000005B), ref: 00DEA19C

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: e7cbf2207494463caf598364d1beec2e238f40b00f2fc76ef445e773ea05402b
Instruction ID: e3e78dbbcb3a941fa9069f79a8c21c19a0d18e2c2338d12b2c294553359bd425
Opcode Fuzzy Hash: e7cbf2207494463caf598364d1beec2e238f40b00f2fc76ef445e773ea05402b
Instruction Fuzzy Hash: 4751D6309057C92AFB35FB6688107EAEFB59F12380F0C859AD5C25B1C2DA54BA4CC776

Function 00DE5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00DE5CE2
GetWindowRect.USER32(00000000,?), ref: 00DE5CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00DE5D59
GetDlgItem.USER32(?,00000002), ref: 00DE5D69
GetWindowRect.USER32(00000000,?), ref: 00DE5D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00DE5DCF
GetDlgItem.USER32(?,000003E9), ref: 00DE5DDD
GetWindowRect.USER32(00000000,?), ref: 00DE5DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00DE5E31
GetDlgItem.USER32(?,000003EA), ref: 00DE5E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00DE5E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00DE5E67

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: bc8022ba4268b654f69159c0fd30bfa67c653b343364c2e6e17dd7b3a5371d04
Instruction ID: 4f7b7369e65d4117b3a66d31327546698bdb26041fc6278fdca278e545c7f903
Opcode Fuzzy Hash: bc8022ba4268b654f69159c0fd30bfa67c653b343364c2e6e17dd7b3a5371d04
Instruction Fuzzy Hash: 4B515FB0B00605AFDF18DF69DD89AAEBBB5FB48740F248129F515E7294D7709E04CB60

Function 00D98BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D98F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D98BE8,?,00000000,?,?,?,?,00D98BBA,00000000,?), ref: 00D98FC5

DestroyWindow.USER32(?), ref: 00D98C81
KillTimer.USER32(00000000,?,?,?,?,00D98BBA,00000000,?), ref: 00D98D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00DD6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00D98BBA,00000000,?), ref: 00DD69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00D98BBA,00000000,?), ref: 00DD69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00D98BBA,00000000), ref: 00DD69D4
DeleteObject.GDI32(00000000), ref: 00DD69E6

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 6c5f6e0abf023ec41b1649a9d3dbbd770eb5a96255c3ce03fac8e98697edb7e5
Instruction ID: a4137c6f9438506a76ea33daedbd23173ce18e1a8e707f1f3dd4f4042f049064
Opcode Fuzzy Hash: 6c5f6e0abf023ec41b1649a9d3dbbd770eb5a96255c3ce03fac8e98697edb7e5
Instruction Fuzzy Hash: A6617930502700DFCF299F26C958B6577B1FB46712F189959E082AB6A0CB71ED94EFB0

Function 00D99838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00D99944: GetWindowLongW.USER32(?,000000EB), ref: 00D99952

GetSysColor.USER32(0000000F), ref: 00D99862

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 216dea6fb832b9fb22f46d94b5a2bd1f97861705d82fcbbd2790a36a8b9fcc25
Instruction ID: af230494023720d8448da8b28dbb61e95857a9e3c83b21c8e948bf15ada0f7ad
Opcode Fuzzy Hash: 216dea6fb832b9fb22f46d94b5a2bd1f97861705d82fcbbd2790a36a8b9fcc25
Instruction Fuzzy Hash: 5E41B131244600AFDF205F3D9C94BB97B65AB06330F28464EF9A2972E1E7319C46DB31

Function 00DE96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00DCF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00DE9717
LoadStringW.USER32(00000000,?,00DCF7F8,00000001), ref: 00DE9720

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00DCF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00DE9742
LoadStringW.USER32(00000000,?,00DCF7F8,00000001), ref: 00DE9745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00DE9866

Strings

Error: , xrefs: 00DE981D
Line %d (File "%s"):, xrefs: 00DE978F
%s (%d) : ==> %s: %s %s, xrefs: 00DE984A
Line %d:, xrefs: 00DE97A0
^ ERROR, xrefs: 00DE97FB

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 7f56f01a542cd460a0def8776f41a5c5f160dd8b791b692451c75f90d3968a9c
Instruction ID: 2625f80723d9b4a70bc28a41fed646a0134017c54f03f9e262893e3f0835b223
Opcode Fuzzy Hash: 7f56f01a542cd460a0def8776f41a5c5f160dd8b791b692451c75f90d3968a9c
Instruction Fuzzy Hash: C4413772800219AACF04FBE1DE96EEEB778EF55740F640025F605B2092EA356F49CB71

Function 00DE06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00D86B57: _wcslen.LIBCMT ref: 00D86B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00DE07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00DE07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00DE07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00DE0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00DE082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00DE0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00DE083C

Strings

SOFTWARE\Classes\, xrefs: 00DE070E
\CLSID, xrefs: 00DE0724
\IPC$, xrefs: 00DE0784

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: c91215e605e8a43c7b6816979088bc49137bfb8bb43dab9baefc15eb0f381f95
Instruction ID: 5ae183885a59bcda8076fd84ac0a81665325a165cfcd41f170c1ca8645a78202
Opcode Fuzzy Hash: c91215e605e8a43c7b6816979088bc49137bfb8bb43dab9baefc15eb0f381f95
Instruction Fuzzy Hash: 3F411372C10229ABDB11FFA5DC958EDB778EF04350B54412AE905B3161EB70AE48CBB0

Function 00E13F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00E1403B
CreateCompatibleDC.GDI32(00000000), ref: 00E14042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00E14055
SelectObject.GDI32(00000000,00000000), ref: 00E1405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00E14068
DeleteDC.GDI32(00000000), ref: 00E14072
GetWindowLongW.USER32(?,000000EC), ref: 00E1407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00E14092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00E1409E

Strings

static, xrefs: 00E13FD3

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: f6d359ac24784aaf63841ed2957a004442fe3305bc12454fb6dd1e8a9cb0dc21
Instruction ID: 013b85b97b24ffe33fd1e75d1045157ad50ca54a4a7fcaf80bd5917d2f4dc2f7
Opcode Fuzzy Hash: f6d359ac24784aaf63841ed2957a004442fe3305bc12454fb6dd1e8a9cb0dc21
Instruction Fuzzy Hash: 9C317872141215AFDB229FA5CC08FDA3BA9EF0D724F204210FA19F21A0C731D864DB60

Function 00E03C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E03C5C
CoInitialize.OLE32(00000000), ref: 00E03C8A
CoUninitialize.OLE32 ref: 00E03C94
_wcslen.LIBCMT ref: 00E03D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00E03DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00E03ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00E03F0E
CoGetObject.OLE32(?,00000000,00E1FB98,?), ref: 00E03F2D
SetErrorMode.KERNEL32(00000000), ref: 00E03F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00E03FC4
VariantClear.OLEAUT32(?), ref: 00E03FD8

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 0334b2a7f3d00c9f4e68bd93df295f067a900701580cc173acfd60cbeb693892
Instruction ID: 554b5a9a06dc9630d4a43239bfca78a97722e65bfd8d1823dfb63a05788121bc
Opcode Fuzzy Hash: 0334b2a7f3d00c9f4e68bd93df295f067a900701580cc173acfd60cbeb693892
Instruction Fuzzy Hash: A7C134716083059FD700DF68C88496BBBE9FF89748F14591DF98AAB290D730ED85CB62

Function 00DF7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00DF7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00DF7B8F
SHGetDesktopFolder.SHELL32(?), ref: 00DF7BA3
CoCreateInstance.OLE32(00E1FD08,00000000,00000001,00E46E6C,?), ref: 00DF7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00DF7C74
CoTaskMemFree.OLE32(?,?), ref: 00DF7CCC
SHBrowseForFolderW.SHELL32(?), ref: 00DF7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00DF7D7A
CoTaskMemFree.OLE32(00000000), ref: 00DF7D81
CoTaskMemFree.OLE32(00000000), ref: 00DF7DD6
CoUninitialize.OLE32 ref: 00DF7DDC

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: c758bf9090fff7880c4fe87090e7a4f742210122b275c2b4999182178337408f
Instruction ID: d6139565be61964d614cd010ec7e1c43fd1b2bc110386b3d16b4f14828911767
Opcode Fuzzy Hash: c758bf9090fff7880c4fe87090e7a4f742210122b275c2b4999182178337408f
Instruction Fuzzy Hash: 42C11B75A04109EFCB14DF64C884DAEBBF9FF48314B158499E919EB261D730EE45CBA0

Function 00E1541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00E15504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E15515
CharNextW.USER32(00000158), ref: 00E15544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00E15585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00E1559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E155AC

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 5709fa913261f53a8d468247d84a7200db9ccbe0482f9edf14792c2e73667ac6
Instruction ID: a902e3d2af77ba861f2a07803f5db723103b038c771b5321d9d8a3114afa0c2f
Opcode Fuzzy Hash: 5709fa913261f53a8d468247d84a7200db9ccbe0482f9edf14792c2e73667ac6
Instruction Fuzzy Hash: 05619072900608EFDF109F55CC84AFE7BB9EB89725F109145F926BB290D7708AC4DB62

Function 00DDFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00DDFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00DDFB08
VariantInit.OLEAUT32(?), ref: 00DDFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00DDFB3A
VariantCopy.OLEAUT32(?,?), ref: 00DDFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00DDFBA1
VariantClear.OLEAUT32(?), ref: 00DDFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00DDFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00DDFBCC
VariantClear.OLEAUT32(?), ref: 00DDFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00DDFBE9

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: e40554a3ae90c0f8da068f24d9c4ad601c3ae4cc40d2fc9bdee7ea8af1848a38
Instruction ID: 0dcca1415039f76b7fa175f47e48129995e2b2203de25e6fb01dbb9fee5b1e64
Opcode Fuzzy Hash: e40554a3ae90c0f8da068f24d9c4ad601c3ae4cc40d2fc9bdee7ea8af1848a38
Instruction Fuzzy Hash: CB417F35A00219EFDB00DFA4D8549EEBBB9EF48344F11806AE956E7361CB30A945CBB0

Function 00DE9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00DE9CA1
GetAsyncKeyState.USER32(000000A0), ref: 00DE9D22
GetKeyState.USER32(000000A0), ref: 00DE9D3D
GetAsyncKeyState.USER32(000000A1), ref: 00DE9D57
GetKeyState.USER32(000000A1), ref: 00DE9D6C
GetAsyncKeyState.USER32(00000011), ref: 00DE9D84
GetKeyState.USER32(00000011), ref: 00DE9D96
GetAsyncKeyState.USER32(00000012), ref: 00DE9DAE
GetKeyState.USER32(00000012), ref: 00DE9DC0
GetAsyncKeyState.USER32(0000005B), ref: 00DE9DD8
GetKeyState.USER32(0000005B), ref: 00DE9DEA

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 54abe1a7cd80671454edfcabb71635cc18269d5d769c73c9fe706f442f0281e7
Instruction ID: 3cd6bcdc381db4796c1499ef4f47cc3b01a201b79164f5f1cffc15d63aff938f
Opcode Fuzzy Hash: 54abe1a7cd80671454edfcabb71635cc18269d5d769c73c9fe706f442f0281e7
Instruction Fuzzy Hash: FD41D6345067D96DFF30BA6288243F5FEA16F11344F1C805ADAC6565C2EBA499C8C7B2

Function 00E0055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00E005BC
inet_addr.WSOCK32(?), ref: 00E0061C
gethostbyname.WSOCK32(?), ref: 00E00628
IcmpCreateFile.IPHLPAPI ref: 00E00636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00E006C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00E006E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00E007B9
WSACleanup.WSOCK32 ref: 00E007BF

Strings

Ping, xrefs: 00E00676

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 67aff9638b237ed6aadde6dfab7c9446e172589379f8c11f65d9a0a39bf39582
Instruction ID: 7777b7face05935e4fcc6a667080fddf20672f2c61f6c9381398e1d68d7662f0
Opcode Fuzzy Hash: 67aff9638b237ed6aadde6dfab7c9446e172589379f8c11f65d9a0a39bf39582
Instruction Fuzzy Hash: 5991A1746042019FD720EF15D888F16BBE0EF45318F1895AAF469AB6A2C734ED85CF91

Function 00E08CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00E08CF3

Part of subcall function 00DE8E54: _wcslen.LIBCMT ref: 00DE8E77

_wcslen.LIBCMT ref: 00E08D4E
_wcslen.LIBCMT ref: 00E08D9C
_wcslen.LIBCMT ref: 00E08DDC
_wcslen.LIBCMT ref: 00E08E6E

Strings

none, xrefs: 00E08E65, 00E08E6A
stdcall, xrefs: 00E08DD6, 00E08DDB
winapi, xrefs: 00E08D96, 00E08D9B
cdecl, xrefs: 00E08D48, 00E08D4D

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 53baf8bbea4dfa4b2f278ea8d63f83749128a8607a5ea0ec557b40ee11bbad33
Instruction ID: 43565961eff33f3d10d25112cdd72a13e54e59a0b3d3e91de60e0175f6ac7a8f
Opcode Fuzzy Hash: 53baf8bbea4dfa4b2f278ea8d63f83749128a8607a5ea0ec557b40ee11bbad33
Instruction Fuzzy Hash: F951B131A005169BCF14DF68CE508BEB7A5FF65728B215229E4A6F72C0DB30DD81C7A0

Function 00E0372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00E03774
CoUninitialize.OLE32 ref: 00E0377F
CoCreateInstance.OLE32(?,00000000,00000017,00E1FB78,?), ref: 00E037D9
IIDFromString.OLE32(?,?), ref: 00E0384C
VariantInit.OLEAUT32(?), ref: 00E038E4
VariantClear.OLEAUT32(?), ref: 00E03936

Strings

NULL Pointer assignment, xrefs: 00E0381E
Invalid parameter, xrefs: 00E03865
Failed to create object, xrefs: 00E037E4, 00E0389A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: b613160d4cd3afc88dba8af02132bbf204ef68633e7f5b0dfc54a38c67b4b339
Instruction ID: e1b5cc221a609787a55d377eb88172d524597a2a4ebcdd61eebf7aaa9e5775d0
Opcode Fuzzy Hash: b613160d4cd3afc88dba8af02132bbf204ef68633e7f5b0dfc54a38c67b4b339
Instruction Fuzzy Hash: AA6191706083019FD314DF64C885BAAB7E8EF49714F14484AF585A72D1C770EE88CBB2

Function 00DF3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00DF33CF

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00DF33F0

Strings

Error: , xrefs: 00DF34D1
"%s" (%d) : ==> %s:, xrefs: 00DF3522
Line %d (File "%s"):, xrefs: 00DF3443, 00DF345C
^ ERROR , xrefs: 00DF349E
Incorrect parameters to object property !, xrefs: 00DF34AB
"%s" (%d) : ==> %s:%s%s, xrefs: 00DF3504

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 7242660398b88906b97e351a1b6c6ec2798147bcd24058a47fb750f132b42fe8
Instruction ID: 4e821414366e304e9fafda1afb2f1b78d0f306bffaae51f0ec75e402d2460f8d
Opcode Fuzzy Hash: 7242660398b88906b97e351a1b6c6ec2798147bcd24058a47fb750f132b42fe8
Instruction Fuzzy Hash: 5D51897290020AAADF14FBA0DD56EFEB378EF04740F254465F105B20A2EB216F58CB71

Function 00DEB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00DEB5FC
_wcslen.LIBCMT ref: 00DEB608
_wcslen.LIBCMT ref: 00DEB64D
_wcslen.LIBCMT ref: 00DEB68C
_wcslen.LIBCMT ref: 00DEB6C7

Strings

EXISTS, xrefs: 00DEB686, 00DEB68B
KEYS, xrefs: 00DEB647, 00DEB64C
REMOVE, xrefs: 00DEB602, 00DEB607
APPEND, xrefs: 00DEB6C1, 00DEB6C6

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 9722eb56e623820f566beafb627a15fcf15ba8323a07cb93c5d9154fe0760be7
Instruction ID: f2d4417dedeb310c3f17722cad06957d21508a5abf88ad40ec02efa1a3512ed1
Opcode Fuzzy Hash: 9722eb56e623820f566beafb627a15fcf15ba8323a07cb93c5d9154fe0760be7
Instruction Fuzzy Hash: 1C41B932A001669BCB107F7E88915BFB7A5ABA1774B28412FE461DF284E731DD81C7B0

Function 00DF5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00DF53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00DF5416
GetLastError.KERNEL32 ref: 00DF5420
SetErrorMode.KERNEL32(00000000,READY), ref: 00DF54A7

Strings

UNKNOWN, xrefs: 00DF5444
NOTREADY, xrefs: 00DF544B
READY, xrefs: 00DF5460, 00DF5468
READONLY, xrefs: 00DF5452
INVALID, xrefs: 00DF5459

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: cce13353d5e8e9d09b26c5e02b1105e7a23a210a018bb331d1c4f45134e8f3ab
Instruction ID: 10f11c4ce8d649a10f7f4e75e1724a067e7a74b8e62353e92e1a5b82dad9655c
Opcode Fuzzy Hash: cce13353d5e8e9d09b26c5e02b1105e7a23a210a018bb331d1c4f45134e8f3ab
Instruction Fuzzy Hash: 6431C235A006089FC710EF68E485AB9BBB4EF45305F19C059EA05DB256D730DD86CBB1

Function 00E13C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00E13C79
SetMenu.USER32(?,00000000), ref: 00E13C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E13D10
IsMenu.USER32(?), ref: 00E13D24
CreatePopupMenu.USER32 ref: 00E13D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00E13D5B
DrawMenuBar.USER32 ref: 00E13D63

Strings

0, xrefs: 00E13C54
F, xrefs: 00E13D4E

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 77cc6502927caf56ee41e08b37a7babfa63873098765eb306f459798c4d37979
Instruction ID: ab3eafdda0dbbffd7ae0b98455ff800f6ffb8288f1ac0aa6825ebb1eb6889f19
Opcode Fuzzy Hash: 77cc6502927caf56ee41e08b37a7babfa63873098765eb306f459798c4d37979
Instruction Fuzzy Hash: C0418978A01209EFDB14CF65E844BEABBB6FF49304F144029F946A7360D730AA14CF90

Function 00DE1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

Part of subcall function 00DE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DE3CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00DE1F64
GetDlgCtrlID.USER32 ref: 00DE1F6F
GetParent.USER32 ref: 00DE1F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00DE1F8E
GetDlgCtrlID.USER32(?), ref: 00DE1F97
GetParent.USER32(?), ref: 00DE1FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00DE1FAE

Strings

ListBox, xrefs: 00DE1F21
ComboBox, xrefs: 00DE1EEC

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 5b39f4d0a3797827048d3ea5f6a35816881b11caca3e0540c1b7656c1949091c
Instruction ID: 87132a44fd3d96a9b7fc32a57387a5288eff8fbcb848ec22a787f5ed6a5e3d4e
Opcode Fuzzy Hash: 5b39f4d0a3797827048d3ea5f6a35816881b11caca3e0540c1b7656c1949091c
Instruction Fuzzy Hash: 8B21DE75A00214BFCF00BFA2CC84DFEBBB8EF05300B144105B9A2A32A1DB358918CBB1

Function 00DE1FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

Part of subcall function 00DE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DE3CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00DE2043
GetDlgCtrlID.USER32 ref: 00DE204E
GetParent.USER32 ref: 00DE206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00DE206D
GetDlgCtrlID.USER32(?), ref: 00DE2076
GetParent.USER32(?), ref: 00DE208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00DE208D

Strings

ListBox, xrefs: 00DE2002
ComboBox, xrefs: 00DE1FCD

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: a36fe19659f24c9b2677edf20f99821f23f6de555bbcf53353fe2a026e069962
Instruction ID: 9aa6d948c6eed7a192d1436039304c8869221e103b66c8636388a8789c74dc68
Opcode Fuzzy Hash: a36fe19659f24c9b2677edf20f99821f23f6de555bbcf53353fe2a026e069962
Instruction Fuzzy Hash: 9B21D1B1940214BFCF11BFA1CC85EFEBBB8EF09300F144405B996A71A1DA758918DB71

Function 00E13A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00E13A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00E13AA0
GetWindowLongW.USER32(?,000000F0), ref: 00E13AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00E13AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00E13B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00E13BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00E13BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00E13BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00E13BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00E13C13

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 942ca061b520e12a6b252b6fa5f909e2c2993409aa3d05a2751161605266db84
Instruction ID: 6e94c2a032ea0071ed496e9c15fae55baa62808cc300ed925a0dc6142df2bb34
Opcode Fuzzy Hash: 942ca061b520e12a6b252b6fa5f909e2c2993409aa3d05a2751161605266db84
Instruction Fuzzy Hash: CE615B75900248AFDB10DFA8CC81EEE77F8EB49714F104199FA15B72A1D770AE85DB60

Function 00DEB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00DEB151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00DEA1E1,?,00000001), ref: 00DEB165
GetWindowThreadProcessId.USER32(00000000), ref: 00DEB16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00DEA1E1,?,00000001), ref: 00DEB17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00DEB18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00DEA1E1,?,00000001), ref: 00DEB1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00DEA1E1,?,00000001), ref: 00DEB1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00DEA1E1,?,00000001), ref: 00DEB1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00DEA1E1,?,00000001), ref: 00DEB212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00DEA1E1,?,00000001), ref: 00DEB21D

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: da074949b5718dd4b2a6f87543a1564a66bd9ff8bdfdd17e1699dc11ef62a4dc
Instruction ID: 96752097fdef1da37c5d5809ea50867e76935910fff48ac663fdfd82c5446409
Opcode Fuzzy Hash: da074949b5718dd4b2a6f87543a1564a66bd9ff8bdfdd17e1699dc11ef62a4dc
Instruction Fuzzy Hash: 9B31C375540344BFDB14AF27DC44BAF7BAABF50362F248406FA01E6190D7B4A9448F78

Function 00DB2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00DB2C94

Part of subcall function 00DB29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00DBD7D1,00000000,00000000,00000000,00000000,?,00DBD7F8,00000000,00000007,00000000,?,00DBDBF5,00000000), ref: 00DB29DE
Part of subcall function 00DB29C8: GetLastError.KERNEL32(00000000,?,00DBD7D1,00000000,00000000,00000000,00000000,?,00DBD7F8,00000000,00000007,00000000,?,00DBDBF5,00000000,00000000), ref: 00DB29F0

_free.LIBCMT ref: 00DB2CA0
_free.LIBCMT ref: 00DB2CAB
_free.LIBCMT ref: 00DB2CB6
_free.LIBCMT ref: 00DB2CC1
_free.LIBCMT ref: 00DB2CCC
_free.LIBCMT ref: 00DB2CD7
_free.LIBCMT ref: 00DB2CE2
_free.LIBCMT ref: 00DB2CED
_free.LIBCMT ref: 00DB2CFB

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a3f51f359e558b8541fb7b63cf28b7b4fe04e671747020e3c859ba5f2b3dd2da
Instruction ID: 4a52d2d80f1b94c74b6e5a59bfcbafc4014c53314c8fda9bff75711d1662785e
Opcode Fuzzy Hash: a3f51f359e558b8541fb7b63cf28b7b4fe04e671747020e3c859ba5f2b3dd2da
Instruction Fuzzy Hash: D5115F76540108FFCB02EF54D982CED3BA5FF09350F5149A5FA4A9B222DB31EA509BB0

Function 00D81410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00D81459
OleUninitialize.OLE32(?,00000000), ref: 00D814F8
UnregisterHotKey.USER32(?), ref: 00D816DD
DestroyWindow.USER32(?), ref: 00DC24B9
FreeLibrary.KERNEL32(?), ref: 00DC251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00DC254B

Strings

close all, xrefs: 00D81454

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: f28ec33c4c3d6a6d176984ac74b8bced0b95f92b2cbd508e0e22a90e7ec14ac1
Instruction ID: 8325c8fcbc613a6a85744cc8f1cfddd44c3e937d0a3d68903e8f08b94233c738
Opcode Fuzzy Hash: f28ec33c4c3d6a6d176984ac74b8bced0b95f92b2cbd508e0e22a90e7ec14ac1
Instruction Fuzzy Hash: B6D125356022128FCB19EF15C895F69F7A4FF45710F2942ADE48AAB261DB30AD16CF70

Function 00DF7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00DF7FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00DF7FC1
GetFileAttributesW.KERNEL32(?), ref: 00DF7FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00DF8005
SetCurrentDirectoryW.KERNEL32(?), ref: 00DF8017
SetCurrentDirectoryW.KERNEL32(?), ref: 00DF8060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00DF80B0

Strings

*.*, xrefs: 00DF8066

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 44a5ad174f5b7e77d61c60cb1e4c739bf93114f835a7b70a0e49f075e8d5c211
Instruction ID: b53cc44e4996f9fc4f9ea6f3993fa91c51ec047bd519a1030eb30b3ab6fc0747
Opcode Fuzzy Hash: 44a5ad174f5b7e77d61c60cb1e4c739bf93114f835a7b70a0e49f075e8d5c211
Instruction Fuzzy Hash: 0981917150824A9BCB20EF14C8449BEB3E8FF89314F59885EFA85D7250EB35DD498B72

Function 00D85BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00D85C7A

Part of subcall function 00D85D0A: GetClientRect.USER32(?,?), ref: 00D85D30
Part of subcall function 00D85D0A: GetWindowRect.USER32(?,?), ref: 00D85D71
Part of subcall function 00D85D0A: ScreenToClient.USER32(?,?), ref: 00D85D99

GetDC.USER32 ref: 00DC46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00DC4708
SelectObject.GDI32(00000000,00000000), ref: 00DC4716
SelectObject.GDI32(00000000,00000000), ref: 00DC472B
ReleaseDC.USER32(?,00000000), ref: 00DC4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00DC47C4

Strings

U, xrefs: 00DC4693

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 6dcd5f715bc0540a60e4b635138818efbcd6b3f80cfe33eca652256ba3c85ba0
Instruction ID: 6de1cbaf98876ff7e27bbb79eb278879c090175e2e863ae7e0341f057ac0a48b
Opcode Fuzzy Hash: 6dcd5f715bc0540a60e4b635138818efbcd6b3f80cfe33eca652256ba3c85ba0
Instruction Fuzzy Hash: D871AD31400206DFCF259F64C994FEA7BB5FF4A364F284269E9556B2AAC7318841DFB0

Function 00DF359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00DF35E4

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

LoadStringW.USER32(00E52390,?,00000FFF,?), ref: 00DF360A

Strings

Error: , xrefs: 00DF36EF
"%s" (%d) : ==> %s:, xrefs: 00DF3742
Line %d (File "%s"):, xrefs: 00DF366B
^ ERROR, xrefs: 00DF36C9
"%s" (%d) : ==> %s:%s%s, xrefs: 00DF3724

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 58686cac1d71013609c8935d0a71bbe9c37898d4fff5464b5f2d32e8be5152bb
Instruction ID: 6e9366f5800511eea9adcaf7e801d9392104dbbb482f8486024759f816337c2e
Opcode Fuzzy Hash: 58686cac1d71013609c8935d0a71bbe9c37898d4fff5464b5f2d32e8be5152bb
Instruction Fuzzy Hash: BF514A7180020ABADF14FBA1DC52EFEBB78EF04700F194165F205721A1EB316A99DBB1

Function 00DFC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00DFC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DFC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00DFC2CA
GetLastError.KERNEL32 ref: 00DFC322
SetEvent.KERNEL32(?), ref: 00DFC336
InternetCloseHandle.WININET(00000000), ref: 00DFC341

Strings

, xrefs: 00DFC2BB

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 910aec2bb3231f345e769ee4587c8bc84f95f0bab723fbbc3f68625992c7440e
Instruction ID: 8ec9c291ddaa8a049b7da13fbd1938c891499d09740f2f48c652dfed5df91f42
Opcode Fuzzy Hash: 910aec2bb3231f345e769ee4587c8bc84f95f0bab723fbbc3f68625992c7440e
Instruction Fuzzy Hash: 6A31D1B161020CAFD7219F618D88ABB7BFCEB09784B19D41EF586D2200DB30DD188B70

Function 00DE989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00DC3AAF,?,?,Bad directive syntax error,00E1CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00DE98BC
LoadStringW.USER32(00000000,?,00DC3AAF,?), ref: 00DE98C3

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00DE9987

Strings

., xrefs: 00DE996D
Line %d (File "%s"):, xrefs: 00DE992D
Line %d:, xrefs: 00DE9912
Error: , xrefs: 00DE9955
%s (%d) : ==> %s.: %s %s, xrefs: 00DE98F1

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 27863bb8ee48e81359c26e77de5f9b735011892b980316f381d5c1ec028d82a9
Instruction ID: 8679e0c0fcb19e5f89a635ec6a76eb6191a161a6fad8fe5d4b6f2ad7315e308d
Opcode Fuzzy Hash: 27863bb8ee48e81359c26e77de5f9b735011892b980316f381d5c1ec028d82a9
Instruction Fuzzy Hash: 9E21593294021ABBCF15BF90DC16EEEB735FF19704F085429B519720A2EA719A28CB71

Function 00DE209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00DE20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00DE20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00DE214D

Strings

list, xrefs: 00DE212F
details, xrefs: 00DE20FB
smallicons, xrefs: 00DE2115
SHELLDLL_DefView, xrefs: 00DE20CC
largeicons, xrefs: 00DE20E1

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 984b9f1c9a3864d72c0c8704c975a73a08b244aabccdc7cf97b709354342d7f9
Instruction ID: 0d216f962b93e76b28e0f26286ed341c74d72074e37845f4318d7ec036c60c5e
Opcode Fuzzy Hash: 984b9f1c9a3864d72c0c8704c975a73a08b244aabccdc7cf97b709354342d7f9
Instruction Fuzzy Hash: 6F11257B6C8706BAFA013622EC07DF6379CCB06728B201016FB04F50E6FEB1A9425635

Function 00DB8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877cd45c7a2e86fa47e4a4d7e91c6533765d736ee57f5f45938a90769212457c
Instruction ID: 231a7d9be48ee997f159df2588366ae0c5958f77316bacb1f96495a9a575dadb
Opcode Fuzzy Hash: 877cd45c7a2e86fa47e4a4d7e91c6533765d736ee57f5f45938a90769212457c
Instruction Fuzzy Hash: D1C1E275A04389EFCB11EFA9D851BEDBBB4AF09310F184099F956A7392CB309941CB71

Function 00DBCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00DBCEB7
_free.LIBCMT ref: 00DBCF22
_free.LIBCMT ref: 00DBCF48
_free.LIBCMT ref: 00DBCF71
_free.LIBCMT ref: 00DBCFA9
_free.LIBCMT ref: 00DBCFDA
_free.LIBCMT ref: 00DBD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00DBD09C
_free.LIBCMT ref: 00DBD0B5

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 3ceb2f079c2abc3ab17a348a93a576e69669b8708472aa55ec3a1d7d2b19e147
Instruction ID: 842672290023ef6b0f56a343675ce7527b3c8a5a0683636ab347861185f00aed
Opcode Fuzzy Hash: 3ceb2f079c2abc3ab17a348a93a576e69669b8708472aa55ec3a1d7d2b19e147
Instruction Fuzzy Hash: 6361F772905301EFDF25AFB49881AF97BA6FF49350F0845ADF947A7281EB3199018770

Function 00E150D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00E15186
ShowWindow.USER32(?,00000000), ref: 00E151C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00E151CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00E151D1

Part of subcall function 00E16FBA: DeleteObject.GDI32(00000000), ref: 00E16FE6

GetWindowLongW.USER32(?,000000F0), ref: 00E1520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E1521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00E1524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00E15287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00E15296

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 31540688790c3e2d1ae958deef55bee332ef32b5e2d25c01307ab4b30f21ecb4
Instruction ID: 6859a7305719d11357417dc4c35a14eaf5ec15848c3b0a15899cff2642b36f95
Opcode Fuzzy Hash: 31540688790c3e2d1ae958deef55bee332ef32b5e2d25c01307ab4b30f21ecb4
Instruction Fuzzy Hash: CA519D73A91A08FEEF219F24CC45BD83BB5EB85325F149006F525B62E0C7B5A9C0DB51

Function 00D98B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00DD6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00DD68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00DD68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00DD68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00DD68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00D98874,00000000,00000000,00000000,000000FF,00000000), ref: 00DD6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00DD691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00D98874,00000000,00000000,00000000,000000FF,00000000), ref: 00DD692D

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 7d2ad35b19ea8391a230ca50cda7f22fb59939e292259af3ad7bda649afcf052
Instruction ID: 96f750b567e84ebaa6e24bbb9919ac563e374f154af9fa5a4fa2ae14b07181b0
Opcode Fuzzy Hash: 7d2ad35b19ea8391a230ca50cda7f22fb59939e292259af3ad7bda649afcf052
Instruction Fuzzy Hash: 1C51A970600209EFDF20CF25CC51FAA7BB5EB48B54F184519F952E72A0DB70E980EBA0

Function 00DFC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00DFC182
GetLastError.KERNEL32 ref: 00DFC195
SetEvent.KERNEL32(?), ref: 00DFC1A9

Part of subcall function 00DFC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00DFC272
Part of subcall function 00DFC253: GetLastError.KERNEL32 ref: 00DFC322
Part of subcall function 00DFC253: SetEvent.KERNEL32(?), ref: 00DFC336
Part of subcall function 00DFC253: InternetCloseHandle.WININET(00000000), ref: 00DFC341

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: ee3cfac48aa3bf10985f723f8a34e3c83295ed4bbed1507c0ef447dba37d92e1
Instruction ID: bcda8e8d60ad1b5741a452fb123a0ea4492f7f12bd52a361dacc85003bb9e854
Opcode Fuzzy Hash: ee3cfac48aa3bf10985f723f8a34e3c83295ed4bbed1507c0ef447dba37d92e1
Instruction Fuzzy Hash: CD318B7125060DAFDB219FA5DE44AB6BBE8FF18300B15D41EFA56D6610C730E924DB70

Function 00DE25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00DE3A57
Part of subcall function 00DE3A3D: GetCurrentThreadId.KERNEL32 ref: 00DE3A5E
Part of subcall function 00DE3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00DE25B3), ref: 00DE3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00DE25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00DE25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00DE25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00DE25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00DE2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00DE2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00DE260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00DE2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00DE2627

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: d6d47c605e765481044f2bd0909e633f1c30c2546b83d2548c443718f42a697a
Instruction ID: d5c6a61c6357b767cd0dc1235a259ec82ee8f085e078ed19d509d890cfd73bac
Opcode Fuzzy Hash: d6d47c605e765481044f2bd0909e633f1c30c2546b83d2548c443718f42a697a
Instruction Fuzzy Hash: D101B5303D0354BFFB106B6A9C8AFA93E59DB4AB11F204011F358EF0D1C9E154848A7A

Function 00DE1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00DE1449,?,?,00000000), ref: 00DE180C
HeapAlloc.KERNEL32(00000000,?,00DE1449,?,?,00000000), ref: 00DE1813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00DE1449,?,?,00000000), ref: 00DE1828
GetCurrentProcess.KERNEL32(?,00000000,?,00DE1449,?,?,00000000), ref: 00DE1830
DuplicateHandle.KERNEL32(00000000,?,00DE1449,?,?,00000000), ref: 00DE1833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00DE1449,?,?,00000000), ref: 00DE1843
GetCurrentProcess.KERNEL32(00DE1449,00000000,?,00DE1449,?,?,00000000), ref: 00DE184B
DuplicateHandle.KERNEL32(00000000,?,00DE1449,?,?,00000000), ref: 00DE184E
CreateThread.KERNEL32(00000000,00000000,00DE1874,00000000,00000000,00000000), ref: 00DE1868

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 58fa4d8af5703762617a390f7d9fbdd68da030a329767839a7c12f5d40f66d80
Instruction ID: cd40cff5693cbae552b54c0dc95933a9bf3d7fc47dbd11b8fcbf19983da57dd6
Opcode Fuzzy Hash: 58fa4d8af5703762617a390f7d9fbdd68da030a329767839a7c12f5d40f66d80
Instruction Fuzzy Hash: D701ACB53C1344BFE610AF66DC49F977B6CEB89B11F108411FA15DB192C67098048B20

Function 00E0A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00DED4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00DED501
Part of subcall function 00DED4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00DED50F
Part of subcall function 00DED4DC: CloseHandle.KERNEL32(00000000), ref: 00DED5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E0A16D
GetLastError.KERNEL32 ref: 00E0A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E0A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00E0A268
GetLastError.KERNEL32(00000000), ref: 00E0A273
CloseHandle.KERNEL32(00000000), ref: 00E0A2C4

Strings

SeDebugPrivilege, xrefs: 00E0A18F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 97faa8ce99c43e8ac63d3f33d1dc23758e0ed219a1c8b600f7419d7bba174f6f
Instruction ID: c780b1708b2ebb673316bf167ff825f5daa40f6e3677a69a0052fcbcb0960596
Opcode Fuzzy Hash: 97faa8ce99c43e8ac63d3f33d1dc23758e0ed219a1c8b600f7419d7bba174f6f
Instruction Fuzzy Hash: B4617C70205342AFD720EF15C494F55BBE1AF54318F1884ACE4669B7A3C772ED89CBA2

Function 00E13886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00E13925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00E1393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00E13954
_wcslen.LIBCMT ref: 00E13999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00E139C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00E139F4

Strings

SysListView32, xrefs: 00E138F7

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: b0de89bf9eaa4cdc24cca36151aa12d509c3f3b78d3fc3bca511fc8344e0d74a
Instruction ID: db01c24170f5488b3da0568e788b64942aa71440f7485e54e4e0dbad543cbb33
Opcode Fuzzy Hash: b0de89bf9eaa4cdc24cca36151aa12d509c3f3b78d3fc3bca511fc8344e0d74a
Instruction Fuzzy Hash: F041C271A00318ABEF219F64CC45BEA7BA9EF48354F101526F948F7281D771DE84CBA0

Function 00DEBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DEBCFD
IsMenu.USER32(00000000), ref: 00DEBD1D
CreatePopupMenu.USER32 ref: 00DEBD53
GetMenuItemCount.USER32(012D5500), ref: 00DEBDA4
InsertMenuItemW.USER32(012D5500,?,00000001,00000030), ref: 00DEBDCC

Strings

2, xrefs: 00DEBD37
0, xrefs: 00DEBCA8

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 27162c2a5f68d51b1c2586bcaa356070ad7da8d8be293118753c5634a26c9031
Instruction ID: b6a798519267f7d385e46d0da7120ffd4d9292b3ff0430bd19ea0a17eb2cd8f4
Opcode Fuzzy Hash: 27162c2a5f68d51b1c2586bcaa356070ad7da8d8be293118753c5634a26c9031
Instruction Fuzzy Hash: 26519370A002859BDB10EFAADC84BAFBBF5EF45324F28411AE452D7290D770A945CB71

Function 00DEC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00DEC913

Strings

stop, xrefs: 00DEC8E4
warning, xrefs: 00DEC8FC
blank, xrefs: 00DEC895
question, xrefs: 00DEC8CC
info, xrefs: 00DEC8B4

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 6b75040e9ffa9bc04e948542ffc62380eb2154674bb6c3d569f4fd822e764114
Instruction ID: 009478e5504e427cc5cde981750587f16f1628431a1628b262c4e298be72b1cd
Opcode Fuzzy Hash: 6b75040e9ffa9bc04e948542ffc62380eb2154674bb6c3d569f4fd822e764114
Instruction Fuzzy Hash: 5E112B316D9346BAE7017B16AC82CAE279CDF16319B20202BF500B6183D7B49D015679

Function 00DEDE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00DEDE42
gethostname.WSOCK32(?,00000100), ref: 00DEDE5C
gethostbyname.WSOCK32(?), ref: 00DEDE69
inet_ntoa.WSOCK32(?), ref: 00DEDEAB
_strcat.LIBCMT ref: 00DEDEB9
WSACleanup.WSOCK32 ref: 00DEDEDE

Strings

0.0.0.0, xrefs: 00DEDE87

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 37b4972b9f2b52c561f3fe0c68f36837ab0b632ee25615882b495fdd1b15ab31
Instruction ID: e9e7c71b773b75f04704bdfe6c0d8f1fb326d62b81d1eb57ae99dd8068b59323
Opcode Fuzzy Hash: 37b4972b9f2b52c561f3fe0c68f36837ab0b632ee25615882b495fdd1b15ab31
Instruction Fuzzy Hash: 03110631904214AFCB24BF72DC4AEEF77ADDF56B10F140169F485E6091EFB19A818A70

Function 00E19F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D99BB2

GetSystemMetrics.USER32(0000000F), ref: 00E19FC7
GetSystemMetrics.USER32(0000000F), ref: 00E19FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00E1A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00E1A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00E1A263
ShowWindow.USER32(00000003,00000000), ref: 00E1A282
InvalidateRect.USER32(?,00000000,00000001), ref: 00E1A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 00E1A2CA

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: fe3cc6756396b1176c1776c0994afe40ac71ce098f3921c976f927b2c0785af2
Instruction ID: 4181cc05f06da2aa21a4ad639d958c3ee80bedb18ed44c6a21f2e8acb3c17b09
Opcode Fuzzy Hash: fe3cc6756396b1176c1776c0994afe40ac71ce098f3921c976f927b2c0785af2
Instruction Fuzzy Hash: DCB19671601215AFDF14CF68C9857FE3BF2BB48705F189079EC89AB2A5D731A980CB61

Function 00DEED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00DEED2A
_wcslen.LIBCMT ref: 00DEED3B
_wcslen.LIBCMT ref: 00DEED79
_wcslen.LIBCMT ref: 00DEEDAF
_wcslen.LIBCMT ref: 00DEEDDF
_wcslen.LIBCMT ref: 00DEEDEF
_wcslen.LIBCMT ref: 00DEEE2B
_wcslen.LIBCMT ref: 00DEEE5A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: c9d2a922b67b33f6a59b62a68b96b816f1a3ccfb68ac23f7f6f09bca86a3aeb4
Instruction ID: 151ca1f8d5e078e3c0493d2e27393543a48d10f15a0167da08e6675c6e8b0ab9
Opcode Fuzzy Hash: c9d2a922b67b33f6a59b62a68b96b816f1a3ccfb68ac23f7f6f09bca86a3aeb4
Instruction Fuzzy Hash: DD41B066C10258A9CB11EBF48C8AACFB7ACEF46710F148466F518E3121FB34E255C7B9

Function 00D9F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00DD682C,00000004,00000000,00000000), ref: 00D9F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00DD682C,00000004,00000000,00000000), ref: 00DDF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00DD682C,00000004,00000000,00000000), ref: 00DDF454

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 75dd4837f4446fcf7dee8f3b85065d3af906eca792eb68a320573ad31c6fcc2b
Instruction ID: c44a515c99f90df77d9d63d7148efee830739ec65dae1c4e86bab85c60da4fb6
Opcode Fuzzy Hash: 75dd4837f4446fcf7dee8f3b85065d3af906eca792eb68a320573ad31c6fcc2b
Instruction Fuzzy Hash: 9341D931614740BECF399F29888876E7B96AB56314F18843DE087E6661D671E884CF31

Function 00E12D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00E12D1B
GetDC.USER32(00000000), ref: 00E12D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E12D2E
ReleaseDC.USER32(00000000,00000000), ref: 00E12D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00E12D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00E12D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00E15A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00E12DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00E12DE1

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: d0341c2191c7da31cd49bb50ecc43d17afdb420dcead771e92b3adc0208f1438
Instruction ID: 1b91fb5d9e55eff81056583d822f7f40912c0cd5173b10ebc57869c86ea75d34
Opcode Fuzzy Hash: d0341c2191c7da31cd49bb50ecc43d17afdb420dcead771e92b3adc0208f1438
Instruction Fuzzy Hash: 0131BC72241210BFEB108F11DC8AFEB3BA9EF09715F048055FE08EA291C6758C51CBA0

Function 00DE5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00DE5637
_memcmp.LIBVCRUNTIME ref: 00DE5659
_memcmp.LIBVCRUNTIME ref: 00DE5671
_memcmp.LIBVCRUNTIME ref: 00DE5684
_memcmp.LIBVCRUNTIME ref: 00DE569E
_memcmp.LIBVCRUNTIME ref: 00DE56B1
_memcmp.LIBVCRUNTIME ref: 00DE56C9
_memcmp.LIBVCRUNTIME ref: 00DE56E4

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 39ad7eed9cdb65ca8db9a2676ff4f299fefe8cfc97fe64a6142fa71ec306be04
Instruction ID: 59347b29982ec3ef6e56fc222cb603b4f5ce13e699117b5eff2dc9e7c1e75e03
Opcode Fuzzy Hash: 39ad7eed9cdb65ca8db9a2676ff4f299fefe8cfc97fe64a6142fa71ec306be04
Instruction Fuzzy Hash: 7721A775B40A497BD614BA22AE92FFB735CEF213C8F580028FD05AA585F760ED5082F5

Function 00E04FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00E05007
NULL Pointer assignment, xrefs: 00E0502E, 00E05383

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 2c41c7f84de0f86ec8528bf0808792cbe69ed42d4c64614159073d2905e5c8a4
Instruction ID: 44766bba379f4bc3e99e14176236a7e6850bc2d02637dd0243df27ee66fcc96f
Opcode Fuzzy Hash: 2c41c7f84de0f86ec8528bf0808792cbe69ed42d4c64614159073d2905e5c8a4
Instruction Fuzzy Hash: 05D17E76A0060A9FDF10CF98C881AAEB7B5FF48344F149469E915BB281D7709D85CFA0

Function 00DC1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00DC15CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00DC1651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DC16E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00DC16FB

Part of subcall function 00DB3820: RtlAllocateHeap.NTDLL(00000000,?,00E51444,?,00D9FDF5,?,?,00D8A976,00000010,00E51440,00D813FC,?,00D813C6,?,00D81129), ref: 00DB3852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DC1777
__freea.LIBCMT ref: 00DC17A2
__freea.LIBCMT ref: 00DC17AE

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: f70d8e51725b9ae4cf7c091ba27765ef1ecad6b3275fe56e73c533728a2ddcab
Instruction ID: e8b0f7afd02fd4d9793c6486124d294800237764e0027eb71f61ae15ce3bfa1e
Opcode Fuzzy Hash: f70d8e51725b9ae4cf7c091ba27765ef1ecad6b3275fe56e73c533728a2ddcab
Instruction Fuzzy Hash: 53919179E102279ADF208E64C891FEE7BB5DF4A310F28465DE802E7182DB35DC458BB0

Function 00E04523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E04648
VariantInit.OLEAUT32(?), ref: 00E04749
VariantClear.OLEAUT32(?), ref: 00E04753
VariantClear.OLEAUT32(?), ref: 00E047B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 00E045D8, 00E04706, 00E047BE
Incorrect Object type in FOR..IN loop, xrefs: 00E0472C

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 5d2fe8840f20fbb7dccabbf93d6ba48656ddb33db370134c1fd9916bdf51ca58
Instruction ID: 135f1e67e178cf3836df9a2e6816c1855e1550e357710a254b3d40db36f9e465
Opcode Fuzzy Hash: 5d2fe8840f20fbb7dccabbf93d6ba48656ddb33db370134c1fd9916bdf51ca58
Instruction Fuzzy Hash: DC91A0B0A00219AFDF20CFA5D944FAE7BB8EF46714F14955AF615BB2C0D7709981CBA0

Function 00DF1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00DF125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00DF1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00DF12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00DF12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00DF135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00DF13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00DF1430

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 79f484c836fa71e68963d7cf6e2a672efbe6af2737966c4bbc3ef5fbb4feb72c
Instruction ID: a944478345375db7da5dc45d92873355eb32df1389634b852144e12513aa7b37
Opcode Fuzzy Hash: 79f484c836fa71e68963d7cf6e2a672efbe6af2737966c4bbc3ef5fbb4feb72c
Instruction Fuzzy Hash: EB91BF79A00209EFDB009F94C885BBEB7B5FF45324F168029EA50EB291D774A945CBB4

Function 00D9948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 36d19cd0b54a72319d93b5e262330d5bfe7c2bc5ca53a944af9a338c9b77b82a
Instruction ID: 8eca3c2c9e9d605094a4bbc6bb315bb26aacb12b79707e316fefc6940457e194
Opcode Fuzzy Hash: 36d19cd0b54a72319d93b5e262330d5bfe7c2bc5ca53a944af9a338c9b77b82a
Instruction Fuzzy Hash: A2912371940219AFCF51CFA9C884AEEBBB8FF49320F24815AE515B7251D374AA42CB70

Function 00E03947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E0396B
CharUpperBuffW.USER32(?,?), ref: 00E03A7A
_wcslen.LIBCMT ref: 00E03A8A
VariantClear.OLEAUT32(?), ref: 00E03C1F

Part of subcall function 00DF0CDF: VariantInit.OLEAUT32(00000000), ref: 00DF0D1F
Part of subcall function 00DF0CDF: VariantCopy.OLEAUT32(?,?), ref: 00DF0D28
Part of subcall function 00DF0CDF: VariantClear.OLEAUT32(?), ref: 00DF0D34

Strings

AUTOIT.ERROR, xrefs: 00E03A80, 00E03A85
Incorrect Parameter format, xrefs: 00E039A6, 00E03BA1

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 2fd767dbe50731e7534ba01051f071eb791f0925134bb29a4227e0704127d0d9
Instruction ID: 1702e3f05dae28d9b13982328be03fc2e2033614da857212dd1548edabfad0c8
Opcode Fuzzy Hash: 2fd767dbe50731e7534ba01051f071eb791f0925134bb29a4227e0704127d0d9
Instruction Fuzzy Hash: BA915A746083059FC704EF24C48196AB7E8FF89318F14896DF899A7391DB31EE45CBA2

Function 00E04BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00DE000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DDFF41,80070057,?,?,?,00DE035E), ref: 00DE002B
Part of subcall function 00DE000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DDFF41,80070057,?,?), ref: 00DE0046
Part of subcall function 00DE000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DDFF41,80070057,?,?), ref: 00DE0054
Part of subcall function 00DE000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DDFF41,80070057,?), ref: 00DE0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00E04C51
_wcslen.LIBCMT ref: 00E04D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00E04DCF
CoTaskMemFree.OLE32(?), ref: 00E04DDA

Strings

NULL Pointer assignment, xrefs: 00E04E23, 00E04E52

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 138cf0f50e1ac60e660f555b1198073afc2255663e09a4135fec474d9b7781f7
Instruction ID: 0f3ed9bb9fb094ff48166f2eba66926dc1176d40f2ce8b4aecf04d79957c4b55
Opcode Fuzzy Hash: 138cf0f50e1ac60e660f555b1198073afc2255663e09a4135fec474d9b7781f7
Instruction Fuzzy Hash: F891F7B1D002199FDF14EFA5C891AEDB7B8FF48314F10816AE515BB291DB709A458F70

Function 00E120FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00E12183
GetMenuItemCount.USER32(00000000), ref: 00E121B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00E121DD
_wcslen.LIBCMT ref: 00E12213
GetMenuItemID.USER32(?,?), ref: 00E1224D
GetSubMenu.USER32(?,?), ref: 00E1225B

Part of subcall function 00DE3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00DE3A57
Part of subcall function 00DE3A3D: GetCurrentThreadId.KERNEL32 ref: 00DE3A5E
Part of subcall function 00DE3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00DE25B3), ref: 00DE3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00E122E3

Part of subcall function 00DEE97B: Sleep.KERNELBASE ref: 00DEE9F3

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 8b47921fa85fd1a6570fc5e7d97c72d2325ed098a4bb776c7fbffdd9cd0f853d
Instruction ID: f9d6995d4e3455755ce9f3af35711851c7ff019db5f7311402a60f2f12ad3354
Opcode Fuzzy Hash: 8b47921fa85fd1a6570fc5e7d97c72d2325ed098a4bb776c7fbffdd9cd0f853d
Instruction Fuzzy Hash: E0718A75A00205AFCB10EF64C841AEEB7F5EF88314F149458EA26FB251D734E981CBA0

Function 00E17E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(012D56B8), ref: 00E17F37
IsWindowEnabled.USER32(012D56B8), ref: 00E17F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00E1801E
SendMessageW.USER32(012D56B8,000000B0,?,?), ref: 00E18051
IsDlgButtonChecked.USER32(?,?), ref: 00E18089
GetWindowLongW.USER32(012D56B8,000000EC), ref: 00E180AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00E180C3

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 6773205c76ea2084ef61d971bff0386b00be46e2df0ef9b53676f2a38bc173a2
Instruction ID: d4b26d6e9a9e0583a3e3a87f702d9d6d4ce8df41af7210f2e8a9b01768911c34
Opcode Fuzzy Hash: 6773205c76ea2084ef61d971bff0386b00be46e2df0ef9b53676f2a38bc173a2
Instruction Fuzzy Hash: 60718B74608204AFEB259F64C884FEBBBB5FF0D704F145499E995B7261CB31AC86CB20

Function 00DEAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00DEAEF9
GetKeyboardState.USER32(?), ref: 00DEAF0E
SetKeyboardState.USER32(?), ref: 00DEAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00DEAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00DEAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00DEAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00DEB020

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: beb836fba3a2c0cdb63c645d6804d7e91726b34fdd197fff18494c7928e49a40
Instruction ID: 3b13429b12957dcb91a3e7396d7da9c6f03fd68d1aba393b0a8c932ff2151aa5
Opcode Fuzzy Hash: beb836fba3a2c0cdb63c645d6804d7e91726b34fdd197fff18494c7928e49a40
Instruction Fuzzy Hash: 5B51B1A06046D63DFB36633A8845BBB7EA95F06714F0C848AF1D9954C2C398FC88D771

Function 00DEACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00DEAD19
GetKeyboardState.USER32(?), ref: 00DEAD2E
SetKeyboardState.USER32(?), ref: 00DEAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00DEADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00DEADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00DEAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00DEAE38

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: b48c75c3098a496e75a39a906f73c49d9ab5608575eafde26dd76394fd289636
Instruction ID: ed1d08010d48258be9f2713e632e3b946f3c6de31bbf7bd891ddf91264432c5b
Opcode Fuzzy Hash: b48c75c3098a496e75a39a906f73c49d9ab5608575eafde26dd76394fd289636
Instruction Fuzzy Hash: DE51D5A16047D63DFB33A22A8C95BBA7E995F45700F0C8489F1D5568C2D294FC88D772

Function 00DB542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00DC3CD6,?,?,?,?,?,?,?,?,00DB5BA3,?,?,00DC3CD6,?,?), ref: 00DB5470
__fassign.LIBCMT ref: 00DB54EB
__fassign.LIBCMT ref: 00DB5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00DC3CD6,00000005,00000000,00000000), ref: 00DB552C
WriteFile.KERNEL32(?,00DC3CD6,00000000,00DB5BA3,00000000,?,?,?,?,?,?,?,?,?,00DB5BA3,?), ref: 00DB554B
WriteFile.KERNEL32(?,?,00000001,00DB5BA3,00000000,?,?,?,?,?,?,?,?,?,00DB5BA3,?), ref: 00DB5584

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: b49f79a21f5c47f5369138a10a22e3b8e7d85f22535e9a6b821866480c59c359
Instruction ID: 38cec6aafc4c325bc47b48f275348d6acf0affcc42f6217f937fda4fc9175c38
Opcode Fuzzy Hash: b49f79a21f5c47f5369138a10a22e3b8e7d85f22535e9a6b821866480c59c359
Instruction Fuzzy Hash: 7351AF71A00649EFDB20CFA8E845BEEBBF9EF09301F14455AF556E7291D6309A41CB70

Function 00DA2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00DA2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00DA2D53
_ValidateLocalCookies.LIBCMT ref: 00DA2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00DA2E0C
_ValidateLocalCookies.LIBCMT ref: 00DA2E61

Strings

csm, xrefs: 00DA2DF6

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5712079567d69f914f7655c2da1ad0d92d8adaa9ea3ebc574e23a04bcf8ce091
Instruction ID: 9ca698e6b59c5f30b77bf33ab064a2b5b62d5df4b2d51b7e8d64938467dd9d97
Opcode Fuzzy Hash: 5712079567d69f914f7655c2da1ad0d92d8adaa9ea3ebc574e23a04bcf8ce091
Instruction Fuzzy Hash: 6C418134A01209ABCF10DF6EC845AAEBBA5FF46324F188155F8146B292D735EA45CBF0

Function 00E010B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E0304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00E0307A
Part of subcall function 00E0304E: _wcslen.LIBCMT ref: 00E0309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00E01112
WSAGetLastError.WSOCK32 ref: 00E01121
WSAGetLastError.WSOCK32 ref: 00E011C9
closesocket.WSOCK32(00000000), ref: 00E011F9

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: ebd90003e71fab5e7ae6064a3d3eb5b88196e44b05e3aa97c8a48259df699ce9
Instruction ID: 3d78fb692661275f59b7d1f4b112ec95df1a00bc4310485aace5ac40b2dc01a2
Opcode Fuzzy Hash: ebd90003e71fab5e7ae6064a3d3eb5b88196e44b05e3aa97c8a48259df699ce9
Instruction Fuzzy Hash: 5F41C131601214AFDB149F64C884BEABBE9EF45368F148099F915AF2D1C770ED85CBE1

Function 00DECF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DEDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00DECF22,?), ref: 00DEDDFD

Part of subcall function 00DEDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00DECF22,?), ref: 00DEDE16

lstrcmpiW.KERNEL32(?,?), ref: 00DECF45
MoveFileW.KERNEL32(?,?), ref: 00DECF7F
_wcslen.LIBCMT ref: 00DED005
_wcslen.LIBCMT ref: 00DED01B
SHFileOperationW.SHELL32(?), ref: 00DED061

Strings

\*.*, xrefs: 00DECFF3

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 0aae22daec26608753b6844b9b6abc6e58374a4c6cffec8b0496efde99f7e403
Instruction ID: be9472dfb827bc401b30588bd3e3a09e52f649fc5c190a8a97c60a36ffc6a675
Opcode Fuzzy Hash: 0aae22daec26608753b6844b9b6abc6e58374a4c6cffec8b0496efde99f7e403
Instruction Fuzzy Hash: 8C4174718462585FDF12FFA5D981ADEB7B9EF48380F1400E6E505EB141EE34A689CB70

Function 00E12DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00E12E1C
GetWindowLongW.USER32(?,000000F0), ref: 00E12E4F
GetWindowLongW.USER32(?,000000F0), ref: 00E12E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00E12EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00E12EE0
GetWindowLongW.USER32(?,000000F0), ref: 00E12EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E12F0B

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: a5ea498cc98f90f2462287bde7c91066936efbd8dd83ade06402dbc3b91547b1
Instruction ID: 99306b7f6065727b52958e01e0479b9de8a4ad194bb41fa66df59dc09b82c193
Opcode Fuzzy Hash: a5ea498cc98f90f2462287bde7c91066936efbd8dd83ade06402dbc3b91547b1
Instruction Fuzzy Hash: C43117306442509FDB22CF19DC84FA537E1EB8AB15F1451A8FA11EB2B1CB71AC94DB01

Function 00DE7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DE7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DE778F
SysAllocString.OLEAUT32(00000000), ref: 00DE7792
SysAllocString.OLEAUT32(?), ref: 00DE77B0
SysFreeString.OLEAUT32(?), ref: 00DE77B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00DE77DE
SysAllocString.OLEAUT32(?), ref: 00DE77EC

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: bf8eff1d01cb11099380954d640b060ccd021e8ad88c514e363244803577514a
Instruction ID: 82e4eb62b38c89f6065956df9ceaeb5f821353781b6d167c6c3baae531790e6d
Opcode Fuzzy Hash: bf8eff1d01cb11099380954d640b060ccd021e8ad88c514e363244803577514a
Instruction Fuzzy Hash: 1B218E76608219AFDF50FFAADC88CFB77ACEB09764B148025BA15DB150D670DC8687B0

Function 00DE77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DE7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DE7868
SysAllocString.OLEAUT32(00000000), ref: 00DE786B
SysAllocString.OLEAUT32 ref: 00DE788C
SysFreeString.OLEAUT32 ref: 00DE7895
StringFromGUID2.OLE32(?,?,00000028), ref: 00DE78AF
SysAllocString.OLEAUT32(?), ref: 00DE78BD

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 7fcbc5124b32fa6db84bc2da304c6a1f72eb67d9e1c23ab25da3e2a6112e09e1
Instruction ID: 02436ebab6077e752021227868ab32080ecdbdcf76a72242bab5b89dbcbbdb03
Opcode Fuzzy Hash: 7fcbc5124b32fa6db84bc2da304c6a1f72eb67d9e1c23ab25da3e2a6112e09e1
Instruction Fuzzy Hash: 0021C131608214AFDF10AFAADCC8DAA77ECEB183607148026F924DB2A0D670DC41CB74

Function 00DF04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00DF04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00DF052E

Strings

nul, xrefs: 00DF0567

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: dfeaf39bedbce320160f0b66006aacdda93f18f12d080745622ffc5f6e848698
Instruction ID: 693b278507131a3169bb3ba1afa6aa58a1517522c4bd679eebb52e81e24db9b2
Opcode Fuzzy Hash: dfeaf39bedbce320160f0b66006aacdda93f18f12d080745622ffc5f6e848698
Instruction Fuzzy Hash: B3215175500309AFDB209F69D844AAA7BB4AF44724F258A19E9A1E72E1D7B0D944CF30

Function 00DF05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00DF05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00DF0601

Strings

nul, xrefs: 00DF0639

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: b71e533eff9e9cd6fd28ee4ee08333a3435347452734df2e3d3ec96ce4741cfe
Instruction ID: 59cf9b762e6541a005d97290d67d91e59b90b6c429e025529f8a3b2a0d678a6c
Opcode Fuzzy Hash: b71e533eff9e9cd6fd28ee4ee08333a3435347452734df2e3d3ec96ce4741cfe
Instruction Fuzzy Hash: 2421B7755003199FDB208F69DC04AAA7BE4BF85720F258A19FEB1E72E1D7B09950CB30

Function 00E140AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00D8604C
Part of subcall function 00D8600E: GetStockObject.GDI32(00000011), ref: 00D86060
Part of subcall function 00D8600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D8606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00E14112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00E1411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00E1412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00E14139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00E14145

Strings

Msctls_Progress32, xrefs: 00E140E3

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 2f071b4e68397f85527844b926b6580b4bac7b74239be33f67334b4d41e2525b
Instruction ID: 3ededc068ab5b06c7ee96ddabb21ea65ad223b083cbb6ca60495dad01cdf7816
Opcode Fuzzy Hash: 2f071b4e68397f85527844b926b6580b4bac7b74239be33f67334b4d41e2525b
Instruction Fuzzy Hash: B411B2B2240219BEEF119F65CC85EE77F9DEF097A8F105110BA18B6190C772DC61DBA4

Function 00DBD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DBD7A3: _free.LIBCMT ref: 00DBD7CC

_free.LIBCMT ref: 00DBD82D

Part of subcall function 00DB29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00DBD7D1,00000000,00000000,00000000,00000000,?,00DBD7F8,00000000,00000007,00000000,?,00DBDBF5,00000000), ref: 00DB29DE
Part of subcall function 00DB29C8: GetLastError.KERNEL32(00000000,?,00DBD7D1,00000000,00000000,00000000,00000000,?,00DBD7F8,00000000,00000007,00000000,?,00DBDBF5,00000000,00000000), ref: 00DB29F0

_free.LIBCMT ref: 00DBD838
_free.LIBCMT ref: 00DBD843
_free.LIBCMT ref: 00DBD897
_free.LIBCMT ref: 00DBD8A2
_free.LIBCMT ref: 00DBD8AD
_free.LIBCMT ref: 00DBD8B8

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 8d769b27367b5800fb1dc9c8346755d23bbdcf69d61dc8fd7fa6f739cdc0aeb6
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 8911B772581B04FADA21BFB0CC46FDB7B99EF05700F404825B29BA6592EF75A5058A70

Function 00DEDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00DEDA74
LoadStringW.USER32(00000000), ref: 00DEDA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00DEDA91
LoadStringW.USER32(00000000), ref: 00DEDA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00DEDADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00DEDAB9

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 01c32717359541dd0a4be5cfe35b42edca9987d5297f233fef0d8c32c043d6d9
Instruction ID: cc95fc7a74c1b7a5c2712072e8387e77385b423fc6ec15354e70ae65843bc995
Opcode Fuzzy Hash: 01c32717359541dd0a4be5cfe35b42edca9987d5297f233fef0d8c32c043d6d9
Instruction Fuzzy Hash: DE0186F69402087FE710ABA19D89EEB737CE708701F5044A2B746F2041EA749E888F74

Function 00DF096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(012CE7F8,012CE7F8), ref: 00DF097B
EnterCriticalSection.KERNEL32(012CE7D8,00000000), ref: 00DF098D
TerminateThread.KERNEL32(?,000001F6), ref: 00DF099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00DF09A9
CloseHandle.KERNEL32(?), ref: 00DF09B8
InterlockedExchange.KERNEL32(012CE7F8,000001F6), ref: 00DF09C8
LeaveCriticalSection.KERNEL32(012CE7D8), ref: 00DF09CF

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: b0ece9daf8fdeb2ebd914ec62bc4fec8ed15c172c5ff4d3eabadba587ca6908b
Instruction ID: e6b46a3e552543d8eab5c46254cbdfecdddbe5bdae499df7f23e4da7572fda6b
Opcode Fuzzy Hash: b0ece9daf8fdeb2ebd914ec62bc4fec8ed15c172c5ff4d3eabadba587ca6908b
Instruction Fuzzy Hash: 63F03131482A12BFD7515F95EE8CBE67B35FF01702F549015F201A18B1D7749469CFA0

Function 00D85D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00D85D30
GetWindowRect.USER32(?,?), ref: 00D85D71
ScreenToClient.USER32(?,?), ref: 00D85D99
GetClientRect.USER32(?,?), ref: 00D85ED7
GetWindowRect.USER32(?,?), ref: 00D85EF8

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 3e511c7af3aa2aeb156f134750def3fc9a21dfc74a0c1fcd1a58c02b1a31ce9f
Instruction ID: cba726003c1c8c8aadeb56ae8cf8e723b38509951a3ceefe3793eb77218d061e
Opcode Fuzzy Hash: 3e511c7af3aa2aeb156f134750def3fc9a21dfc74a0c1fcd1a58c02b1a31ce9f
Instruction Fuzzy Hash: FDB16974A0064ADBDB10DFA9C840BEAB7F1FF58310F14851AE8A9D7254DB34EA51DB60

Function 00DB01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00DB00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DB00D6
__allrem.LIBCMT ref: 00DB00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DB010B
__allrem.LIBCMT ref: 00DB0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DB0140

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 2f116d35057715d4f43ca64e10d997c9d7c6f6a709997c393188d14ad50ec34d
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 4281B576A00706DFE724AB68CC41BAB77E9EF42764F28452EF552D7281E770D9048770

Function 00E01D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E03149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,00E0101C,00000000,?,?,00000000), ref: 00E03195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00E01DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00E01DE1
WSAGetLastError.WSOCK32 ref: 00E01DF2
inet_ntoa.WSOCK32(?), ref: 00E01E8C
htons.WSOCK32(?,?,?,?,?), ref: 00E01EDB
_strlen.LIBCMT ref: 00E01F35

Part of subcall function 00DE39E8: _strlen.LIBCMT ref: 00DE39F2

Part of subcall function 00D86D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00D9CF58,?,?,?), ref: 00D86DBA
Part of subcall function 00D86D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00D9CF58,?,?,?), ref: 00D86DED

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 7cc561aa3722dbc580d33216ac254a852b5f96b86cdde5558ca3e52974ea2a31
Instruction ID: 3bf8e033d07ddfcb9bdaaa7f9bec85990c015a914d665a3bfc254ee4f00793d8
Opcode Fuzzy Hash: 7cc561aa3722dbc580d33216ac254a852b5f96b86cdde5558ca3e52974ea2a31
Instruction Fuzzy Hash: E5A1B031204341AFC714EF24C895E6A7BA5EF85318F54998CF4566F2E2CB31ED85CBA1

Function 00DB61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00DA82D9,00DA82D9,?,?,?,00DB644F,00000001,00000001,8BE85006), ref: 00DB6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00DB644F,00000001,00000001,8BE85006,?,?,?), ref: 00DB62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00DB63D8
__freea.LIBCMT ref: 00DB63E5

Part of subcall function 00DB3820: RtlAllocateHeap.NTDLL(00000000,?,00E51444,?,00D9FDF5,?,?,00D8A976,00000010,00E51440,00D813FC,?,00D813C6,?,00D81129), ref: 00DB3852

__freea.LIBCMT ref: 00DB63EE
__freea.LIBCMT ref: 00DB6413

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 06f9b1bb31ba8ed5e490ad49ede031d1487e3200b81203187a02ed13c4744d29
Instruction ID: 29c47cc24c4ff8f9b0f6545540359defc09c5909c84ef7441a23ea86e7fb54b5
Opcode Fuzzy Hash: 06f9b1bb31ba8ed5e490ad49ede031d1487e3200b81203187a02ed13c4744d29
Instruction Fuzzy Hash: ED51AF72A00216EBEB258F64DC81EEF7BA9EB44750F594669FC06D6240DB38DC44D670

Function 00E0BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

Part of subcall function 00E0C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E0B6AE,?,?), ref: 00E0C9B5
Part of subcall function 00E0C998: _wcslen.LIBCMT ref: 00E0C9F1
Part of subcall function 00E0C998: _wcslen.LIBCMT ref: 00E0CA68
Part of subcall function 00E0C998: _wcslen.LIBCMT ref: 00E0CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E0BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E0BD25
RegCloseKey.ADVAPI32(00000000), ref: 00E0BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00E0BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00E0BDF3
RegCloseKey.ADVAPI32(?), ref: 00E0BDFF

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: b59661733c88ffa6b44635766b617054c2612502d9ef020ee105a4d37ee13f11
Instruction ID: 02122131b185bc4c87f64aec7a39310ab9847a3f03d3b680c73696330b0b650e
Opcode Fuzzy Hash: b59661733c88ffa6b44635766b617054c2612502d9ef020ee105a4d37ee13f11
Instruction Fuzzy Hash: CA81A330208241EFD714EF64C895E6ABBE5FF84308F14855DF4599B2A2DB31ED85CBA2

Function 00DDF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00DDF7B9
SysAllocString.OLEAUT32(00000001), ref: 00DDF860
VariantCopy.OLEAUT32(00DDFA64,00000000), ref: 00DDF889
VariantClear.OLEAUT32(00DDFA64), ref: 00DDF8AD
VariantCopy.OLEAUT32(00DDFA64,00000000), ref: 00DDF8B1
VariantClear.OLEAUT32(?), ref: 00DDF8BB

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: d6bb4c4a01bef520da0ec4c1ff25024a7fd16e384e21d8a9ace1d684b96e78b6
Instruction ID: 722a6c1d8eeef5f94aabcfaed521ed44d6df7316f97964efe971eddfb2258c0f
Opcode Fuzzy Hash: d6bb4c4a01bef520da0ec4c1ff25024a7fd16e384e21d8a9ace1d684b96e78b6
Instruction Fuzzy Hash: BD51C531940310BACF20AF65D8A5B2DB3A8EF45310B249467E907EF391DB708C40CBB6

Function 00DF910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00D87620: _wcslen.LIBCMT ref: 00D87625

Part of subcall function 00D86B57: _wcslen.LIBCMT ref: 00D86B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00DF94E5
_wcslen.LIBCMT ref: 00DF9506
_wcslen.LIBCMT ref: 00DF952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00DF9585

Strings

X, xrefs: 00DF9412

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: d51a4abe17321980d08afbaea25e4a19382fdffe3a9a04c9c01c9982071aa68d
Instruction ID: 054695cad45ac766476bf62ca6a28c02662b2d55d7fcdd234e1971e274624fad
Opcode Fuzzy Hash: d51a4abe17321980d08afbaea25e4a19382fdffe3a9a04c9c01c9982071aa68d
Instruction Fuzzy Hash: 04E18E719083009FC714EF24C891B6AB7E4FF85314F19896DE9899B2A2DB31DD05CBB2

Function 00D9920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00D99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D99BB2

BeginPaint.USER32(?,?,?), ref: 00D99241
GetWindowRect.USER32(?,?), ref: 00D992A5
ScreenToClient.USER32(?,?), ref: 00D992C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00D992D3
EndPaint.USER32(?,?,?,?,?), ref: 00D99321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00DD71EA

Part of subcall function 00D99339: BeginPath.GDI32(00000000), ref: 00D99357

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: a4d6a70460250764e95eba4fd973487b183108cd3fcbc44fdf68e8f9da633ef8
Instruction ID: 7b7eb472d0aa4425e42599048711972e22ee58988241d1d732cef2e97181de62
Opcode Fuzzy Hash: a4d6a70460250764e95eba4fd973487b183108cd3fcbc44fdf68e8f9da633ef8
Instruction Fuzzy Hash: 1441BD70104300AFDB21DF29CC95FAABBB8EB86721F1406ADF995D72A1D7309849DB71

Function 00DF07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00DF080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00DF0847
EnterCriticalSection.KERNEL32(?), ref: 00DF0863
LeaveCriticalSection.KERNEL32(?), ref: 00DF08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00DF08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00DF0921

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 37f2aaefad705fd96fd18b372622f482154d35106f640988e837ae3cab915cce
Instruction ID: 8f3564737b2359ecb24b951a9464f7a47de795244a178869df0223bac5d04677
Opcode Fuzzy Hash: 37f2aaefad705fd96fd18b372622f482154d35106f640988e837ae3cab915cce
Instruction Fuzzy Hash: 34414975A00209AFDF14AF54DC85AAA7BB8FF04310B1880A5ED00EB297D730DE55DBB0

Function 00E181DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00DDF3AB,00000000,?,?,00000000,?,00DD682C,00000004,00000000,00000000), ref: 00E1824C
EnableWindow.USER32(?,00000000), ref: 00E18272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00E182D1
ShowWindow.USER32(?,00000004), ref: 00E182E5
EnableWindow.USER32(?,00000001), ref: 00E1830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00E1832F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 2a2fdd7094059a7f2e2aff77eea27325460e8cdec04aeb0c588bf2e12ff4a1e2
Instruction ID: edf12cd70ba84223bda74339fbd4ee9072989d35e0742bf3689b58f3beefc3fd
Opcode Fuzzy Hash: 2a2fdd7094059a7f2e2aff77eea27325460e8cdec04aeb0c588bf2e12ff4a1e2
Instruction Fuzzy Hash: DA411930601600EFDB16CF15C995BE47BE0FB46719F1861A9E518AF2B2CB71AC85CF40

Function 00DE4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00DE4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00DE4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00DE4CEA
_wcslen.LIBCMT ref: 00DE4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00DE4D10
_wcsstr.LIBVCRUNTIME ref: 00DE4D1A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 022a7b8b74ba6e26e0a7c3106f4ae6a7e53e4aa4474faf6971bab3ab2a37db5b
Instruction ID: aa33547b5644a80084c5da6ffb7fbc7802c042d6767d086db5051302f56894ae
Opcode Fuzzy Hash: 022a7b8b74ba6e26e0a7c3106f4ae6a7e53e4aa4474faf6971bab3ab2a37db5b
Instruction Fuzzy Hash: 4F21F672204240BFEB156B3BAC49E7B7B9CDF45B50F248029F805DA192EA61DC4096B1

Function 00DF581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D83AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D83A97,?,?,00D82E7F,?,?,?,00000000), ref: 00D83AC2

_wcslen.LIBCMT ref: 00DF587B
CoInitialize.OLE32(00000000), ref: 00DF5995
CoCreateInstance.OLE32(00E1FCF8,00000000,00000001,00E1FB68,?), ref: 00DF59AE
CoUninitialize.OLE32 ref: 00DF59CC

Strings

.lnk, xrefs: 00DF5876, 00DF58C1, 00DF5985

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 7a78d9683c25779b203deade9b2631013cc3d7f5b4c4958db913fabbfea4ac09
Instruction ID: 9dcaaa3218af50a44c96bec774ff61dd990af3bd71f11f21ee1b7a9345c514de
Opcode Fuzzy Hash: 7a78d9683c25779b203deade9b2631013cc3d7f5b4c4958db913fabbfea4ac09
Instruction Fuzzy Hash: 41D164746087059FC704EF24D480A2ABBE1FF89710F15889DFA8A9B361D731ED45CBA2

Function 00DE175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00DE0FCA
Part of subcall function 00DE0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00DE0FD6
Part of subcall function 00DE0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00DE0FE5
Part of subcall function 00DE0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00DE0FEC
Part of subcall function 00DE0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00DE1002

GetLengthSid.ADVAPI32(?,00000000,00DE1335), ref: 00DE17AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00DE17BA
HeapAlloc.KERNEL32(00000000), ref: 00DE17C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00DE17DA
GetProcessHeap.KERNEL32(00000000,00000000,00DE1335), ref: 00DE17EE
HeapFree.KERNEL32(00000000), ref: 00DE17F5

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: f170156babb0b4e06838416bdf4ca18c2bde305bea25a65025d08e7b3e865fa2
Instruction ID: 45958f00a1c47ddec8a8aac09fc5e1697b2fbe6f142b8cf43a17c9e54469f4a4
Opcode Fuzzy Hash: f170156babb0b4e06838416bdf4ca18c2bde305bea25a65025d08e7b3e865fa2
Instruction Fuzzy Hash: F211AC35681205FFDB10AFA6CC49BAE7BB9FB45755F248018F481E7210C735A988CB70

Function 00DE14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00DE14FF
OpenProcessToken.ADVAPI32(00000000), ref: 00DE1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00DE1515
CloseHandle.KERNEL32(00000004), ref: 00DE1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00DE154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00DE1563

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 8cb2f1573935128734a658d41f0427a5ccd8e49d6f864e5abd5f0964afcdd162
Instruction ID: 74d944b697acd4a421928a40d74482ddd046ac320b22bb40001fbae00874ccc7
Opcode Fuzzy Hash: 8cb2f1573935128734a658d41f0427a5ccd8e49d6f864e5abd5f0964afcdd162
Instruction Fuzzy Hash: FD115676600249AFDF129FA9DD49BDE7BB9FF48704F188025FA15A21A0C371CE64DB60

Function 00DA3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00DA3379,00DA2FE5), ref: 00DA3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00DA339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00DA33B7
SetLastError.KERNEL32(00000000,?,00DA3379,00DA2FE5), ref: 00DA3409

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1afd49c5a72f0e34c50aef652b7aed24ab7ee964ad9ca07028c985c056ea1855
Instruction ID: cb856d5aca97f2901f63cf7f3ac5d55369952e41650868f0a10f5b8957b23c04
Opcode Fuzzy Hash: 1afd49c5a72f0e34c50aef652b7aed24ab7ee964ad9ca07028c985c056ea1855
Instruction Fuzzy Hash: C7017B3364E311BFEF642BB6BC855672A96EB07779334422DF420921F0EF514D0A5574

Function 00DB2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00DB5686,00DC3CD6,?,00000000,?,00DB5B6A,?,?,?,?,?,00DAE6D1,?,00E48A48), ref: 00DB2D78
_free.LIBCMT ref: 00DB2DAB
_free.LIBCMT ref: 00DB2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00DAE6D1,?,00E48A48,00000010,00D84F4A,?,?,00000000,00DC3CD6), ref: 00DB2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00DAE6D1,?,00E48A48,00000010,00D84F4A,?,?,00000000,00DC3CD6), ref: 00DB2DEC
_abort.LIBCMT ref: 00DB2DF2

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 877d397c66d34ddb0d5376b04989d9b1b4b703368fe7d9e93a1d0a24d1747f19
Instruction ID: cd12159ff02d856bd016dd3ae0d4fb3dad5fc90cfa19dc6902af004146a625a6
Opcode Fuzzy Hash: 877d397c66d34ddb0d5376b04989d9b1b4b703368fe7d9e93a1d0a24d1747f19
Instruction Fuzzy Hash: 1EF0A437585600EBC6123739AC0AAFA2569EBC67B1B384518F82BE2196EF24980651B1

Function 00E18A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00D99639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D99693
Part of subcall function 00D99639: SelectObject.GDI32(?,00000000), ref: 00D996A2
Part of subcall function 00D99639: BeginPath.GDI32(?), ref: 00D996B9
Part of subcall function 00D99639: SelectObject.GDI32(?,00000000), ref: 00D996E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00E18A4E
LineTo.GDI32(?,00000003,00000000), ref: 00E18A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00E18A70
LineTo.GDI32(?,00000000,00000003), ref: 00E18A80
EndPath.GDI32(?), ref: 00E18A90
StrokePath.GDI32(?), ref: 00E18AA0

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 63af444796c6f4182b1703a9bfa1c73ea16842f399f63b748cfd54b444efc356
Instruction ID: 383dcf3961889dd36615360c0ea7761b8123b76e58a2ac0e54ab51b71180b503
Opcode Fuzzy Hash: 63af444796c6f4182b1703a9bfa1c73ea16842f399f63b748cfd54b444efc356
Instruction Fuzzy Hash: 74110976040108FFDF129F95DC88EEA7F6CEF08394F10C452BA19AA1A1C7719D59DBA0

Function 00DE51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DE5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00DE5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00DE5230
ReleaseDC.USER32(00000000,00000000), ref: 00DE5238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00DE524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00DE5261

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 0ddeb37562ef87b0c5b56c8d09a29787f32e40d365673e9d1f3b4f1cf9c16e66
Instruction ID: 5b29e124f0600e8c37646992de2a277ba0801345fc30d99aa3d899c1bc9b3006
Opcode Fuzzy Hash: 0ddeb37562ef87b0c5b56c8d09a29787f32e40d365673e9d1f3b4f1cf9c16e66
Instruction Fuzzy Hash: 60018475A40704BFEB105FA69C49A9EBF78EF48751F148065FA04E7280D6709804CBA0

Function 00D81BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D81BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00D81BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D81C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D81C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00D81C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D81C22

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 86f63e8898478391f97b5986528806d46a0d54e43bbe65dddefbc93d3450baf0
Instruction ID: 8b69697b6b15f97d012bbb0c918e67749c4be8bdb4ad4f7692dcfaa12858a4a9
Opcode Fuzzy Hash: 86f63e8898478391f97b5986528806d46a0d54e43bbe65dddefbc93d3450baf0
Instruction Fuzzy Hash: 12016CB0942759BDE3008F5A8C85B52FFA8FF19754F00411B915C47941C7F5A864CBE5

Function 00DEEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00DEEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00DEEB46
GetWindowThreadProcessId.USER32(?,?), ref: 00DEEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DEEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DEEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DEEB75

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: a449ae903e8d9d27fe77ec3b835195b0210ca87eb0b24dc6fc911fdde2a08de2
Instruction ID: 82cad8c8c8d77db4eca64535491c8881ea72eb6b07481661d123efdc44d084b0
Opcode Fuzzy Hash: a449ae903e8d9d27fe77ec3b835195b0210ca87eb0b24dc6fc911fdde2a08de2
Instruction Fuzzy Hash: 77F03A72681168BFE7215B639C0EEEF3A7CEFCAF11F108158F612E1091E7A05A05C6B5

Function 00DD7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00DD7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00DD7469
GetWindowDC.USER32(?), ref: 00DD7475
GetPixel.GDI32(00000000,?,?), ref: 00DD7484
ReleaseDC.USER32(?,00000000), ref: 00DD7496
GetSysColor.USER32(00000005), ref: 00DD74B0

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 67ad687c1c6a39512c0f5732c29a384c22df02c92480862ca1dac686a4d64489
Instruction ID: d8a72f806ef30528f01958510d2e8b01cf4f6f80dfcd123c91f45b22091a67f6
Opcode Fuzzy Hash: 67ad687c1c6a39512c0f5732c29a384c22df02c92480862ca1dac686a4d64489
Instruction Fuzzy Hash: 01018631440215EFEB515FA5DC08BEA7BB6FB04321F6580A4F91AE21A0CB312E45EB61

Function 00DE1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00DE187F
UnloadUserProfile.USERENV(?,?), ref: 00DE188B
CloseHandle.KERNEL32(?), ref: 00DE1894
CloseHandle.KERNEL32(?), ref: 00DE189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00DE18A5
HeapFree.KERNEL32(00000000), ref: 00DE18AC

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 30929ef918ce96b02456e02a5856127198362d7dfb13ab0a4e02ba42403e3a56
Instruction ID: c38c1a0050d517b98e9275c56a3facb17c1e92b67eff79be462c18b154c393c5
Opcode Fuzzy Hash: 30929ef918ce96b02456e02a5856127198362d7dfb13ab0a4e02ba42403e3a56
Instruction Fuzzy Hash: A4E0C236584211BFDA015FA2ED0C98ABB3AFB49B22B20C221F235E10B1CB729464DB50

Function 00D8BBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00D8BEB3

Strings

D%, xrefs: 00D8BCA5
D%, xrefs: 00D8BDED, 00D8BD91, 00D8BD1B
D%, xrefs: 00D8BE9A
D%, xrefs: 00D8BCA2

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%$D%$D%$D%
API String ID: 1385522511-2722557190
Opcode ID: 76d19080b5bc4d2c2f7e07a5030011b1fdc078575367c94e6542b2ac3183bd34
Instruction ID: d12609ee5f1f029043f3550775892103ff962a4270a80a3a8b287623ce7cded1
Opcode Fuzzy Hash: 76d19080b5bc4d2c2f7e07a5030011b1fdc078575367c94e6542b2ac3183bd34
Instruction Fuzzy Hash: B3913C75A00606DFCB18DF69C0906A9BBF1FF59320F24456ED985AB351E731E981CBE0

Function 00DEC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D87620: _wcslen.LIBCMT ref: 00D87625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00DEC6EE
_wcslen.LIBCMT ref: 00DEC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00DEC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00DEC7CA

Strings

0, xrefs: 00DEC6AF

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 4bc8a158da828b5bea70033f4424ef25c306af580b3cf11ae7e5e29b9dafd15f
Instruction ID: 9748ce8e0962ceae4d941f83ea2960aa03d90d61a5cd2a4a5dfe15c4c7c851f4
Opcode Fuzzy Hash: 4bc8a158da828b5bea70033f4424ef25c306af580b3cf11ae7e5e29b9dafd15f
Instruction Fuzzy Hash: 5F51C4716243809BD715BF2AC885B6B77E8EF85314F08292DF995E31A0D770DD0A8B72

Function 00E0AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00E0AEA3

Part of subcall function 00D87620: _wcslen.LIBCMT ref: 00D87625

GetProcessId.KERNEL32(00000000), ref: 00E0AF38
CloseHandle.KERNEL32(00000000), ref: 00E0AF67

Strings

<, xrefs: 00E0AE6B
@, xrefs: 00E0AE72

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: a799660534f54b31c1fc08dd34b480c6d4d2420e26d2bf5ff17cab25c8eab634
Instruction ID: 99827f4f2932b497a5af11eeb39e6a3cd234d49309079bb7c0b33f0f97064f42
Opcode Fuzzy Hash: a799660534f54b31c1fc08dd34b480c6d4d2420e26d2bf5ff17cab25c8eab634
Instruction Fuzzy Hash: 03716C71A00619DFCB14EF54C484A9EBBF0FF08314F1884A9E856AB792C774ED85CBA1

Function 00DE719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00DE7206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00DE723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00DE724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00DE72CF

Strings

DllGetClassObject, xrefs: 00DE7242

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 9b8a6c37dd0de753982b78e16eafc5fe44888392f093ffc2fdaba57ffb580878
Instruction ID: b9d2b58b8325302979c3de7fd6b6cf60e454e26d42512eb6995e7d9e72b0b2cf
Opcode Fuzzy Hash: 9b8a6c37dd0de753982b78e16eafc5fe44888392f093ffc2fdaba57ffb580878
Instruction Fuzzy Hash: 64419F71A04245EFDB55DF56C884A9A7BB9EF44310F2480A9BE05EF20AD7B0DD44CBB0

Function 00E13D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E13E35
IsMenu.USER32(?), ref: 00E13E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00E13E92
DrawMenuBar.USER32 ref: 00E13EA5

Strings

0, xrefs: 00E13D89

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 657669b6d97fee62be6a0f9cdcede4ba5ed009eaf84f27d4ba95bbed99ab9647
Instruction ID: 73324c78e7eaf09b49f8c3fce2253e7ab6224310fb9e9e0fe4dcb10cd54ce5c7
Opcode Fuzzy Hash: 657669b6d97fee62be6a0f9cdcede4ba5ed009eaf84f27d4ba95bbed99ab9647
Instruction Fuzzy Hash: 9D416875A00309EFDB10DF61D884AEABBB9FF49354F048129E915A7290D730AE88CF60

Function 00DE1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

Part of subcall function 00DE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DE3CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00DE1E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00DE1E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00DE1EA9

Part of subcall function 00D86B57: _wcslen.LIBCMT ref: 00D86B6A

Strings

ListBox, xrefs: 00DE1E25
ComboBox, xrefs: 00DE1DF0

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 1197da34b0aac0da786c1a6a14b3a5c93f63a0d7984bc911ed1df74b11a47a89
Instruction ID: 3989666705994511e07dfe63ca3bb6c287ca8a3f4a8a9ee6f2909c9933f18ace
Opcode Fuzzy Hash: 1197da34b0aac0da786c1a6a14b3a5c93f63a0d7984bc911ed1df74b11a47a89
Instruction Fuzzy Hash: CE212175A00144AFDB14BBA2DC4ACFFB7B8EF41760B284119F822A31E1EB3489098730

Function 00E0C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E0C9F1
_wcslen.LIBCMT ref: 00E0CA68
_wcslen.LIBCMT ref: 00E0CA9E
_wcslen.LIBCMT ref: 00E0CAF9
_wcslen.LIBCMT ref: 00E0CB2F
_wcslen.LIBCMT ref: 00E0CB7F

Strings

HKLM, xrefs: 00E0CA98, 00E0CA9D
HKEY_LOCAL_MACHINE, xrefs: 00E0CA62, 00E0CA67

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 579e523f9ed766dccb71f45a6948427a3a45f57d1ca4b150f02178b02675a57b
Instruction ID: aac2e170601985000f5b5907602cdb9f88565c8049e0ad09e363efdddcecaa68
Opcode Fuzzy Hash: 579e523f9ed766dccb71f45a6948427a3a45f57d1ca4b150f02178b02675a57b
Instruction Fuzzy Hash: 0D31F732B0016A4BCB20DF6C98511BF33B19BA1758B256219E8577B2C5E670CDC4C3B0

Function 00E12F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00E12F8D
LoadLibraryW.KERNEL32(?), ref: 00E12F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00E12FA9
DestroyWindow.USER32(?), ref: 00E12FB1

Strings

SysAnimate32, xrefs: 00E12F68

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: d681860976a6b6ec696e3d15172c416e3e40d95d300ada2f3e89a3f423a4cc4a
Instruction ID: 7ea2a9db7c3d99279463853d13631a6a67fd7d46439978dd7af2acc1669cc6ad
Opcode Fuzzy Hash: d681860976a6b6ec696e3d15172c416e3e40d95d300ada2f3e89a3f423a4cc4a
Instruction Fuzzy Hash: B9218871200209AFEB204F649C84EFB37B9EB5D368F10661CFA50F21A0D771DCA29760

Function 00DA4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00DA4D1E,00DB28E9,?,00DA4CBE,00DB28E9,00E488B8,0000000C,00DA4E15,00DB28E9,00000002), ref: 00DA4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DA4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00DA4D1E,00DB28E9,?,00DA4CBE,00DB28E9,00E488B8,0000000C,00DA4E15,00DB28E9,00000002,00000000), ref: 00DA4DC3

Strings

CorExitProcess, xrefs: 00DA4D98
mscoree.dll, xrefs: 00DA4D86

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3a385fad000acc5712a17f2983494591d910f4c43f61d2662060ac1f78543b20
Instruction ID: 63f414fc6867b821dadffde3375212e762ac5adde3f768f6f4f5de76645165e7
Opcode Fuzzy Hash: 3a385fad000acc5712a17f2983494591d910f4c43f61d2662060ac1f78543b20
Instruction Fuzzy Hash: 07F0AF34A80218BFDB109F91DC49BEDBFB4EF44711F1440A4F80AF22A0CF709944CAA1

Function 00DDD3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00DDD3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00DDD3BF
FreeLibrary.KERNEL32(00000000), ref: 00DDD3E5

Strings

X64, xrefs: 00DDD2A8
GetSystemWow64DirectoryW, xrefs: 00DDD3B9

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: a0a9c74c4cd1f4ec545e52a4bf4988c1ec9c2e186d2591b67c8bc98939ac9d48
Instruction ID: 9f1c8249bf3ce14f3a5a37470f8d0acc7ec36a4fbf7207968e6d73659794472b
Opcode Fuzzy Hash: a0a9c74c4cd1f4ec545e52a4bf4988c1ec9c2e186d2591b67c8bc98939ac9d48
Instruction Fuzzy Hash: 82F0A031586621ABDF312B118C589A97A36AF50701B69A197F886F1314DB60CD8886B7

Function 00D84E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00D84EDD,?,00E51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D84E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00D84EAE
FreeLibrary.KERNEL32(00000000,?,?,00D84EDD,?,00E51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D84EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00D84EA8
kernel32.dll, xrefs: 00D84E94

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: b85b28e138c7bb3132e96e946fdd84715060bde1a613a3d76f9567b1707ca132
Instruction ID: 1b2260ba0c73393720d30e87b6ed93cb21a57ddc703a2dcc6d40edb8f16c82e4
Opcode Fuzzy Hash: b85b28e138c7bb3132e96e946fdd84715060bde1a613a3d76f9567b1707ca132
Instruction Fuzzy Hash: F4E08635B826237F92222F266C18A9B6664AF81B627194115FC01F2100DB64CD0542B1

Function 00D84E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00DC3CDE,?,00E51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D84E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00D84E74
FreeLibrary.KERNEL32(00000000,?,?,00DC3CDE,?,00E51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D84E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00D84E6E
kernel32.dll, xrefs: 00D84E5B

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: f45273d48a804e775d720df9d8dd398044b1d143088aa5187fcbba42404c1259
Instruction ID: 8bd989bb06ef290d376c40973bd1b300320e94e05774a802c2deef0d20d0bed7
Opcode Fuzzy Hash: f45273d48a804e775d720df9d8dd398044b1d143088aa5187fcbba42404c1259
Instruction Fuzzy Hash: 6BD012356836226B56632F277C18DCB6A28AF85B513194515B915F2114CF64CD0586E1

Function 00DF2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00DF2C05
DeleteFileW.KERNEL32(?), ref: 00DF2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00DF2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00DF2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00DF2CC0

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 0a6fd7c3ca675537d94d8e7c0a7be2f8df281f2daefb11f986ab0908d5e8a6dd
Instruction ID: 3446ff681904f691f0592f973b8cd7313c3ad7c27ca21318a0ebe711ef65e9d3
Opcode Fuzzy Hash: 0a6fd7c3ca675537d94d8e7c0a7be2f8df281f2daefb11f986ab0908d5e8a6dd
Instruction Fuzzy Hash: 47B11C7190011DABDF21EFA4DC85EEEBBBDEF49350F1080A6F609E6155EA309A448F71

Function 00E0A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00E0A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00E0A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00E0A468
CloseHandle.KERNEL32(?), ref: 00E0A63D

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 883dc90f061044d730f5ebe34467dd763bc1ab74d120dd3eddd41e85dbe8cfe1
Instruction ID: 107241e4b407b70cd9923bfc2b476be8b7ef0bd7dec622dc9bae6ceca629597a
Opcode Fuzzy Hash: 883dc90f061044d730f5ebe34467dd763bc1ab74d120dd3eddd41e85dbe8cfe1
Instruction Fuzzy Hash: E3A1A3716043009FD720EF24D886F2AB7E5EF84714F18985DF55A9B2D2D771EC418BA2

Function 00DEE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DEDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00DECF22,?), ref: 00DEDDFD

Part of subcall function 00DEDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00DECF22,?), ref: 00DEDE16

Part of subcall function 00DEE199: GetFileAttributesW.KERNEL32(?,00DECF95), ref: 00DEE19A

lstrcmpiW.KERNEL32(?,?), ref: 00DEE473
MoveFileW.KERNEL32(?,?), ref: 00DEE4AC
_wcslen.LIBCMT ref: 00DEE5EB
_wcslen.LIBCMT ref: 00DEE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00DEE650

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 5e73a646b4c216c8a6dd55d579826b54471c00bde4edf826622a328cb20adc3a
Instruction ID: 59308977f80caecd2a2e8f7112628b9eb03158051dd9fd99c0787f8473ca278d
Opcode Fuzzy Hash: 5e73a646b4c216c8a6dd55d579826b54471c00bde4edf826622a328cb20adc3a
Instruction Fuzzy Hash: 725180B24083855BC724EB91D8919EFB3ECEF85340F04491EF589D3191EE75E6888776

Function 00E0B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

Part of subcall function 00E0C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E0B6AE,?,?), ref: 00E0C9B5
Part of subcall function 00E0C998: _wcslen.LIBCMT ref: 00E0C9F1
Part of subcall function 00E0C998: _wcslen.LIBCMT ref: 00E0CA68
Part of subcall function 00E0C998: _wcslen.LIBCMT ref: 00E0CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E0BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E0BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00E0BB63
RegCloseKey.ADVAPI32(?,?), ref: 00E0BBA6
RegCloseKey.ADVAPI32(00000000), ref: 00E0BBB3

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: b689cdc0309146fb39cda871634b925aabd3291804a3345ca8998a72d5da54e7
Instruction ID: 9020cf260911e868a4da57e91795bdce32c85d52f245595f856d0d4d44690159
Opcode Fuzzy Hash: b689cdc0309146fb39cda871634b925aabd3291804a3345ca8998a72d5da54e7
Instruction Fuzzy Hash: F4617E31208241AFD714EF14C490E6ABBF5FF84308F54959DF4999B2A2DB31ED85CBA2

Function 00DE8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00DE8BCD
VariantClear.OLEAUT32 ref: 00DE8C3E
VariantClear.OLEAUT32 ref: 00DE8C9D
VariantClear.OLEAUT32(?), ref: 00DE8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00DE8D3B

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 5a16a12a827fc3e09c74b226c5d9af378d64611a06c5b0e23d2e1f8e723cfef2
Instruction ID: b32662312d629faaccb2727ce7b874f4aa5bba4d11f23bf6f43e4d190ed5644d
Opcode Fuzzy Hash: 5a16a12a827fc3e09c74b226c5d9af378d64611a06c5b0e23d2e1f8e723cfef2
Instruction Fuzzy Hash: B1518CB5A00259EFCB10DF59C884AAAB7F5FF89310B158559F919DB350E730E911CFA0

Function 00DF8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00DF8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00DF8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00DF8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00DF8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00DF8C5F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 6770648d924ff40e88645fe8ee8a446953ba65cb9a7774ae3f6d8eb01af8b91c
Instruction ID: 4a0ba5f30b7e9bf1e1fd4ade67852b006f0ff39e435ff231522dfa06a5ae43ec
Opcode Fuzzy Hash: 6770648d924ff40e88645fe8ee8a446953ba65cb9a7774ae3f6d8eb01af8b91c
Instruction Fuzzy Hash: 70514C35A006199FCB04EF65C880A69BBF5FF48314F19C498E949AB362CB31ED41DBB1

Function 00E08EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00E08F40
GetProcAddress.KERNEL32(00000000,?), ref: 00E08FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00E08FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00E09032
FreeLibrary.KERNEL32(00000000), ref: 00E09052

Part of subcall function 00D9F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00DF1043,?,753CE610), ref: 00D9F6E6
Part of subcall function 00D9F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00DDFA64,00000000,00000000,?,?,00DF1043,?,753CE610,?,00DDFA64), ref: 00D9F70D

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: f48ecc6f46d05fdce2b902f80256ba862fd5778d06a25fcc753af7a10abda118
Instruction ID: e8c6fc94a16e8d1017b50d326c163d1ee757b70902d4207ab688ddb6ea8a6188
Opcode Fuzzy Hash: f48ecc6f46d05fdce2b902f80256ba862fd5778d06a25fcc753af7a10abda118
Instruction Fuzzy Hash: 5C513F35605205DFC715EF64C4948ADBBF1FF49324B1890A9E846AB3A2DB31ED85CFA0

Function 00E16B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00E16C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00E16C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00E16C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00DFAB79,00000000,00000000), ref: 00E16C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00E16CC7

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: d23f284ccf245076e77181dd2cce85180f1ad103ea1510d64c2bb0f2d7c2f469
Instruction ID: ca7de917ecf2d81127faf0de63e1d00d5c77ce00cc7cbd371b057fe1a21c7a91
Opcode Fuzzy Hash: d23f284ccf245076e77181dd2cce85180f1ad103ea1510d64c2bb0f2d7c2f469
Instruction Fuzzy Hash: 3041E435A04104AFDB24CF29CC58FE9BBA5EB49354F155268F995F72E0C371ED81CA90

Function 00DB2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00DB20C3
_free.LIBCMT ref: 00DB20E3

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 853542eac3a7971e86273162dcde46866326c92c57bbf19b318e3af55842df32
Instruction ID: a0888e47272a8a664569808936d328369b70f3d5a7f32b89356d7bbbd731f9b6
Opcode Fuzzy Hash: 853542eac3a7971e86273162dcde46866326c92c57bbf19b318e3af55842df32
Instruction Fuzzy Hash: AC41C177A00200EFCB24DF78C881AADB7B5EF89714B194568E516EB355DB31ED01CBA0

Function 00D9912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00D99141
ScreenToClient.USER32(00000000,?), ref: 00D9915E
GetAsyncKeyState.USER32(00000001), ref: 00D99183
GetAsyncKeyState.USER32(00000002), ref: 00D9919D

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 1fdaa5a8fbf7438bf0cf69a9f9a9436e6f35536158c12b1b7d51d123e1456fd9
Instruction ID: 6abbf97d72d4f4553b47a13dc613840ba3dbe1dc0ad3d9585cacedde6eacc675
Opcode Fuzzy Hash: 1fdaa5a8fbf7438bf0cf69a9f9a9436e6f35536158c12b1b7d51d123e1456fd9
Instruction Fuzzy Hash: A9417E71A0861AEBDF059F68C854BEEF774FB05320F24835AE469A32D0D7306994CBA1

Function 00DF3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00DF38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00DF3922
TranslateMessage.USER32(?), ref: 00DF394B
DispatchMessageW.USER32(?), ref: 00DF3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DF3966

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 6ddc0257954adc0ce347819d9c575085ce6be69fa160954b3559378af82abd78
Instruction ID: 08dea7f65ab3a75d3fcb099ac3ade3e22e07972f05cb59155d910fe72407421c
Opcode Fuzzy Hash: 6ddc0257954adc0ce347819d9c575085ce6be69fa160954b3559378af82abd78
Instruction Fuzzy Hash: 8E31EB7054434A9EEB39CB36D848BB637A8EB05345F1B895DD662D2190E3F49688CF31

Function 00DFCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00DFCF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00DFCF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00DFC21E,00000000), ref: 00DFCFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00DFC21E,00000000), ref: 00DFCFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00DFC21E,00000000), ref: 00DFCFF2

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 3aa89b6a667a6c27f50a1c656883e61a4a1f8a656850ddd6cfcb843932949e10
Instruction ID: 791a34cb088e774d0ebfdad3c1b602bd584603699919717744a1bdbbcd79ce09
Opcode Fuzzy Hash: 3aa89b6a667a6c27f50a1c656883e61a4a1f8a656850ddd6cfcb843932949e10
Instruction Fuzzy Hash: F9316B7151520DAFDB20DFA5C984ABABBFAEF04314B25842EF606E2150DB30EE54DB70

Function 00DE1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00DE1915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00DE19C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00DE19C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00DE19DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00DE19E2

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 7f6660a17b71af43b06ce98194b7eff36c1c32a79fed3c30dbe996f00fd51cdf
Instruction ID: 8e1a122864f125e1e191b8f432b4e8701696cf1bfc1bf8faaeae396f81665f4d
Opcode Fuzzy Hash: 7f6660a17b71af43b06ce98194b7eff36c1c32a79fed3c30dbe996f00fd51cdf
Instruction Fuzzy Hash: 1E31C275A00259EFCB00DFA9CD99ADE3BB5EB04315F148225F961E72D1C7709944CFA1

Function 00E15706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00E15745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00E1579D
_wcslen.LIBCMT ref: 00E157AF
_wcslen.LIBCMT ref: 00E157BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00E15816

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: bff3c1f3090f485dd49cd9ec4a0da6b3a309b9ffa193005ef3d60fc75c29cd43
Instruction ID: aa47044a40c41f5db380511c7d035a60bcdcc213eb85813f596f2e8a52fbc54e
Opcode Fuzzy Hash: bff3c1f3090f485dd49cd9ec4a0da6b3a309b9ffa193005ef3d60fc75c29cd43
Instruction Fuzzy Hash: F821A572904618DADB209F61CC85AEE77B8FF85724F109216F92AFA1C0D77089C5CF51

Function 00E00930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00E00951
GetForegroundWindow.USER32 ref: 00E00968
GetDC.USER32(00000000), ref: 00E009A4
GetPixel.GDI32(00000000,?,00000003), ref: 00E009B0
ReleaseDC.USER32(00000000,00000003), ref: 00E009E8

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 9aae1e60b00515d1073f9b74539c7af26d070d6890bc8c6545511fb0c1d3bee1
Instruction ID: 140546c72d5ccee054dacadb26b7f7b2e90f73f5c11aa107ce5da8da7ec27c15
Opcode Fuzzy Hash: 9aae1e60b00515d1073f9b74539c7af26d070d6890bc8c6545511fb0c1d3bee1
Instruction Fuzzy Hash: A1218179600204AFD704EF65D884AAEBBF5EF84700F14C069F94AE7362CB70AC44CBA0

Function 00DBCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00DBCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DBCDE9

Part of subcall function 00DB3820: RtlAllocateHeap.NTDLL(00000000,?,00E51444,?,00D9FDF5,?,?,00D8A976,00000010,00E51440,00D813FC,?,00D813C6,?,00D81129), ref: 00DB3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00DBCE0F
_free.LIBCMT ref: 00DBCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DBCE31

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: b5b67bad198c88885fb9c24e096bb25797524bea4c344d4559d1b6e2bf9939c3
Instruction ID: 8fbdeacc5c26985ce61b9c23c08d29ded52285945b6d26c307c31e5714c915bb
Opcode Fuzzy Hash: b5b67bad198c88885fb9c24e096bb25797524bea4c344d4559d1b6e2bf9939c3
Instruction Fuzzy Hash: 9901D472612215FF23211AB76C88DFB6A6DFFC6BA13295129F906DB200EA60CD0181B0

Function 00D9990C Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00D998CC
SetTextColor.GDI32(?,?), ref: 00D998D6
SetBkMode.GDI32(?,00000001), ref: 00D998E9
GetStockObject.GDI32(00000005), ref: 00D998F1
GetWindowLongW.USER32(?,000000EB), ref: 00D99952

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: 04d867d18a769266a1d6de574fef7a8e920a2c22bea10a6d40798f2916b8d067
Instruction ID: f8fcd1caf3fc6b1c6897a1900c7e46fde440d8e4500130131c04f5e503b44aeb
Opcode Fuzzy Hash: 04d867d18a769266a1d6de574fef7a8e920a2c22bea10a6d40798f2916b8d067
Instruction Fuzzy Hash: 062104716862806FDF224F3DAC68BE57F619B07321F2C429EE5E29A1A1D7214845CB61

Function 00D99639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D99693
SelectObject.GDI32(?,00000000), ref: 00D996A2
BeginPath.GDI32(?), ref: 00D996B9
SelectObject.GDI32(?,00000000), ref: 00D996E2

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 1177309c80fbea5af0bf520c4619ba3648572f191c8a431aec1d9e51b857f4b9
Instruction ID: 8ca92d453531ea33c7d5338bac437bcbd828e2e47baeeba85b904e81636816c0
Opcode Fuzzy Hash: 1177309c80fbea5af0bf520c4619ba3648572f191c8a431aec1d9e51b857f4b9
Instruction Fuzzy Hash: AA21B370802305EFDF109F6AEC247E97B78BB91366F24465AF410B21B0D3709859CBA0

Function 00DE5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00DE5726
_memcmp.LIBVCRUNTIME ref: 00DE5744
_memcmp.LIBVCRUNTIME ref: 00DE5757
_memcmp.LIBVCRUNTIME ref: 00DE576F
_memcmp.LIBVCRUNTIME ref: 00DE5787

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 156859d204ee3dc1ee9e645a6aeb6f213fcc48934a6b5353bd800398aefa22e4
Instruction ID: 23c5dcca61ec36f520078eff52e2468fefdf65b5eb411b58fbd24698c1a6574b
Opcode Fuzzy Hash: 156859d204ee3dc1ee9e645a6aeb6f213fcc48934a6b5353bd800398aefa22e4
Instruction Fuzzy Hash: 6C01B5B6645749FBD609B512AD92FFB735CDB223D8F144020FD09AA245F760ED6082F4

Function 00DB2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00DAF2DE,00DB3863,00E51444,?,00D9FDF5,?,?,00D8A976,00000010,00E51440,00D813FC,?,00D813C6), ref: 00DB2DFD
_free.LIBCMT ref: 00DB2E32
_free.LIBCMT ref: 00DB2E59
SetLastError.KERNEL32(00000000,00D81129), ref: 00DB2E66
SetLastError.KERNEL32(00000000,00D81129), ref: 00DB2E6F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: ffe9a6bfbcc3e33621a2a52e6d0ecff3ffb43d5973c448f6fdb19e04c81ddf8b
Instruction ID: cf13a5a01423dea63d46addd81d0725140db09d2412f9b1c7ac8a59543963945
Opcode Fuzzy Hash: ffe9a6bfbcc3e33621a2a52e6d0ecff3ffb43d5973c448f6fdb19e04c81ddf8b
Instruction Fuzzy Hash: C001D637186600EBC61366376C45DFF1569EBC57617344428F867F2292EF24CC064130

Function 00DE000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DDFF41,80070057,?,?,?,00DE035E), ref: 00DE002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DDFF41,80070057,?,?), ref: 00DE0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DDFF41,80070057,?,?), ref: 00DE0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DDFF41,80070057,?), ref: 00DE0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DDFF41,80070057,?,?), ref: 00DE0070

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: a5e1a4c8c37a1026366d6d2d9ac4e28bfee01f9829f0e5d96eb26dcc8f1580b5
Instruction ID: df6a07f7110e845a05a36ffc3d51bf89844e3146433a9e8e054056c863d2a958
Opcode Fuzzy Hash: a5e1a4c8c37a1026366d6d2d9ac4e28bfee01f9829f0e5d96eb26dcc8f1580b5
Instruction Fuzzy Hash: 08018F72640204BFDB10AF6ADC44BAA7EADEB44752F288124F905E2210D7B1DD84CBB0

Function 00DE10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00DE1114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00DE0B9B,?,?,?), ref: 00DE1120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00DE0B9B,?,?,?), ref: 00DE112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00DE0B9B,?,?,?), ref: 00DE1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00DE114D

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: aab5acbc753f478dabb48a711d5a4f004065a3733d280e0ce55fc241b0441d83
Instruction ID: c62cf917ef5137566537045dd9f21c580e53737c547e6f6395db8c979f496638
Opcode Fuzzy Hash: aab5acbc753f478dabb48a711d5a4f004065a3733d280e0ce55fc241b0441d83
Instruction Fuzzy Hash: 25016D79240305BFDB115F66DC49AAA3B6EEF85360B244415FA45D3350DA71DC408A60

Function 00DE0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00DE0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00DE0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00DE0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00DE0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00DE1002

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 080e78058e12bd4cf9c7db1d0523c0f198cdc53ef83b0ae412176a11eb5d68a8
Instruction ID: 49ac1ab5e83b02a52bdc1fbbc298333c7eaeb386c56a01d53af51e9d9a22ef8e
Opcode Fuzzy Hash: 080e78058e12bd4cf9c7db1d0523c0f198cdc53ef83b0ae412176a11eb5d68a8
Instruction Fuzzy Hash: 3EF0AF39280301BFD7211FA69C49F963B6EEF89761F218414F905D6290CA30DC408A60

Function 00DE1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00DE102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00DE1036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DE1045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00DE104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DE1062

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a83d0ce0d51783b3f8764e89873e338956337ec9e5679b44b75e4e22820f89c7
Instruction ID: d8f57f0ecdd3ce2c8b37b984bcef2bfdfb07f760897193951213e5c919a7ce92
Opcode Fuzzy Hash: a83d0ce0d51783b3f8764e89873e338956337ec9e5679b44b75e4e22820f89c7
Instruction Fuzzy Hash: AFF0C239280301FFD7211FA6EC49F963B6EEF89761F614414F905D7250CA30D8408A70

Function 00DF030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00DF017D,?,00DF32FC,?,00000001,00DC2592,?), ref: 00DF0324
CloseHandle.KERNEL32(?,?,?,?,00DF017D,?,00DF32FC,?,00000001,00DC2592,?), ref: 00DF0331
CloseHandle.KERNEL32(?,?,?,?,00DF017D,?,00DF32FC,?,00000001,00DC2592,?), ref: 00DF033E
CloseHandle.KERNEL32(?,?,?,?,00DF017D,?,00DF32FC,?,00000001,00DC2592,?), ref: 00DF034B
CloseHandle.KERNEL32(?,?,?,?,00DF017D,?,00DF32FC,?,00000001,00DC2592,?), ref: 00DF0358
CloseHandle.KERNEL32(?,?,?,?,00DF017D,?,00DF32FC,?,00000001,00DC2592,?), ref: 00DF0365

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2fd1de3011491218230dc7e3cdecc3c322f4edcddad7d75ddc308a86d73d58ae
Instruction ID: 9e29e563e977871163326241c42e8107d3130e40aba7f93829fde12f7e48e79f
Opcode Fuzzy Hash: 2fd1de3011491218230dc7e3cdecc3c322f4edcddad7d75ddc308a86d73d58ae
Instruction Fuzzy Hash: DC01A272800B199FC7309F66D880822FBF9BF5031531ACA3FD29652932C371A958CF90

Function 00DBD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00DBD752

Part of subcall function 00DB29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00DBD7D1,00000000,00000000,00000000,00000000,?,00DBD7F8,00000000,00000007,00000000,?,00DBDBF5,00000000), ref: 00DB29DE
Part of subcall function 00DB29C8: GetLastError.KERNEL32(00000000,?,00DBD7D1,00000000,00000000,00000000,00000000,?,00DBD7F8,00000000,00000007,00000000,?,00DBDBF5,00000000,00000000), ref: 00DB29F0

_free.LIBCMT ref: 00DBD764
_free.LIBCMT ref: 00DBD776
_free.LIBCMT ref: 00DBD788
_free.LIBCMT ref: 00DBD79A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 773edc71942e1e16781d6c9c394a1b116c50775c1ded929d4e32b9f4aa46dddb
Instruction ID: cc63b90f7f926cb9f6ad558ba361911010f750d9f846472a557bb625e01e079b
Opcode Fuzzy Hash: 773edc71942e1e16781d6c9c394a1b116c50775c1ded929d4e32b9f4aa46dddb
Instruction Fuzzy Hash: D9F0C936545204FB8A65EA65F9858AA77DAFB497107A80C05F14BE7501DF20F8818A74

Function 00DE5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00DE5C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00DE5C6F
MessageBeep.USER32(00000000), ref: 00DE5C87
KillTimer.USER32(?,0000040A), ref: 00DE5CA3
EndDialog.USER32(?,00000001), ref: 00DE5CBD

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 553189419b137f57eb921db7447388cd33ce627182494829c7b5b71dc1795d7c
Instruction ID: 1076c7f4d6572df6c47fb72647556fcc4b7feca854282e4e616c3a52c5482bd9
Opcode Fuzzy Hash: 553189419b137f57eb921db7447388cd33ce627182494829c7b5b71dc1795d7c
Instruction Fuzzy Hash: 54018630540B44AFEB206F12ED5EFE677B8BF04B49F144559A583B10E5DBF0A988CBA0

Function 00DB22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00DB22BE

Part of subcall function 00DB29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00DBD7D1,00000000,00000000,00000000,00000000,?,00DBD7F8,00000000,00000007,00000000,?,00DBDBF5,00000000), ref: 00DB29DE
Part of subcall function 00DB29C8: GetLastError.KERNEL32(00000000,?,00DBD7D1,00000000,00000000,00000000,00000000,?,00DBD7F8,00000000,00000007,00000000,?,00DBDBF5,00000000,00000000), ref: 00DB29F0

_free.LIBCMT ref: 00DB22D0
_free.LIBCMT ref: 00DB22E3
_free.LIBCMT ref: 00DB22F4
_free.LIBCMT ref: 00DB2305

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 05b7a397b8ea12ba19258708737788262a93305454bcc37f5e032d0b1f017629
Instruction ID: 4a61858a517019e7a85aeffbee6e79c1b52464a7e2c1d4b12f2c71233c9107b2
Opcode Fuzzy Hash: 05b7a397b8ea12ba19258708737788262a93305454bcc37f5e032d0b1f017629
Instruction Fuzzy Hash: 35F0547A541310DF8A5AAF56BC029A83B64F719752B150E46F419F3371CB301415AFF5

Function 00D995C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00D995D4
StrokeAndFillPath.GDI32(?,?,00DD71F7,00000000,?,?,?), ref: 00D995F0
SelectObject.GDI32(?,00000000), ref: 00D99603
DeleteObject.GDI32 ref: 00D99616
StrokePath.GDI32(?), ref: 00D99631

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 63646ed11450b8fea4dfb1587ffc5be599134fcbffe5cf3c527e3823dc9d39e2
Instruction ID: 2630a07bf622962d5695905364f2381d9578f1fd2029bf53bfbd2c1eaca0707f
Opcode Fuzzy Hash: 63646ed11450b8fea4dfb1587ffc5be599134fcbffe5cf3c527e3823dc9d39e2
Instruction Fuzzy Hash: 2FF03C30046304EFDB1A5F6AED2C7A93B61AB85363F148658F465B50F0C7308999DF64

Function 00DB0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00DB10F9
__freea.LIBCMT ref: 00DB1117

Part of subcall function 00DB1537: _free.LIBCMT ref: 00DB154F

Strings

am/pm, xrefs: 00DB117A
a/p, xrefs: 00DB11DE

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 1d30c366879de43d0636b69fcc7e916efc0c0002394b319f6ad0e3de832de08d
Instruction ID: 96834cedc3103b8685287d0d8bc089e45b99c61d6610f5a1aa79837b11ac293f
Opcode Fuzzy Hash: 1d30c366879de43d0636b69fcc7e916efc0c0002394b319f6ad0e3de832de08d
Instruction Fuzzy Hash: 1FD1E239900206CADB249F68C865BFEB7B1EF06340FAC4259E9439B750E7759D80CBB1

Function 00E061D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00DA0242: EnterCriticalSection.KERNEL32(00E5070C,00E51884,?,?,00D9198B,00E52518,?,?,?,00D812F9,00000000), ref: 00DA024D
Part of subcall function 00DA0242: LeaveCriticalSection.KERNEL32(00E5070C,?,00D9198B,00E52518,?,?,?,00D812F9,00000000), ref: 00DA028A

Part of subcall function 00DA00A3: __onexit.LIBCMT ref: 00DA00A9

__Init_thread_footer.LIBCMT ref: 00E06238

Part of subcall function 00DA01F8: EnterCriticalSection.KERNEL32(00E5070C,?,?,00D98747,00E52514), ref: 00DA0202
Part of subcall function 00DA01F8: LeaveCriticalSection.KERNEL32(00E5070C,?,00D98747,00E52514), ref: 00DA0235

Part of subcall function 00DF359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00DF35E4
Part of subcall function 00DF359C: LoadStringW.USER32(00E52390,?,00000FFF,?), ref: 00DF360A

Strings

x#, xrefs: 00E0636F
x#, xrefs: 00E06353
x#, xrefs: 00E0633A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#$x#$x#
API String ID: 1072379062-1894725482
Opcode ID: 6186a62522206563519d14958b9b9a7ae3ea63a11f2870c4b3bc2d1c0fbeb5e7
Instruction ID: a4e5818642ad47dc85f47450ad85b732b8c3d04f309ce14a23b649f833ea457f
Opcode Fuzzy Hash: 6186a62522206563519d14958b9b9a7ae3ea63a11f2870c4b3bc2d1c0fbeb5e7
Instruction Fuzzy Hash: 89C1B471A00205AFCB14EF98C891EBEB7B9FF49304F148419F955AB291DB70ED94CBA0

Function 00E07B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00DA0242: EnterCriticalSection.KERNEL32(00E5070C,00E51884,?,?,00D9198B,00E52518,?,?,?,00D812F9,00000000), ref: 00DA024D
Part of subcall function 00DA0242: LeaveCriticalSection.KERNEL32(00E5070C,?,00D9198B,00E52518,?,?,?,00D812F9,00000000), ref: 00DA028A

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

Part of subcall function 00DA00A3: __onexit.LIBCMT ref: 00DA00A9

__Init_thread_footer.LIBCMT ref: 00E07BFB

Part of subcall function 00DA01F8: EnterCriticalSection.KERNEL32(00E5070C,?,?,00D98747,00E52514), ref: 00DA0202
Part of subcall function 00DA01F8: LeaveCriticalSection.KERNEL32(00E5070C,?,00D98747,00E52514), ref: 00DA0235

Strings

5, xrefs: 00E07C78
G, xrefs: 00E07C7F
Variable must be of type 'Object'., xrefs: 00E07C3A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 8570b39537db3f0f8d149136d5b4924d08d4c99d8b9a69f090c6a2a014b9d62d
Instruction ID: 6e1879620836cee45f5b3d384635a38cb0bc98ae3976fcdf3008339b4e7c968e
Opcode Fuzzy Hash: 8570b39537db3f0f8d149136d5b4924d08d4c99d8b9a69f090c6a2a014b9d62d
Instruction Fuzzy Hash: 6D919C74A04209EFCB04EF94D8919BDB7B1FF49304F149059F886BB292DB71AE85CB61

Function 00DE2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DEB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00DE21D0,?,?,00000034,00000800,?,00000034), ref: 00DEB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00DE2760

Part of subcall function 00DEB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00DE21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00DEB3F8

Part of subcall function 00DEB32A: GetWindowThreadProcessId.USER32(?,?), ref: 00DEB355
Part of subcall function 00DEB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00DE2194,00000034,?,?,00001004,00000000,00000000), ref: 00DEB365
Part of subcall function 00DEB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00DE2194,00000034,?,?,00001004,00000000,00000000), ref: 00DEB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00DE27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00DE281A

Strings

@, xrefs: 00DE2832

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 787601bb7fcd2fc32e8062bb26a38d2ca6b9ebe5111ad1fb444acad8f5ef9a38
Instruction ID: 14710c2b755432105988849488a5cef02e81a59b1385dab1498e94547e385467
Opcode Fuzzy Hash: 787601bb7fcd2fc32e8062bb26a38d2ca6b9ebe5111ad1fb444acad8f5ef9a38
Instruction Fuzzy Hash: B8414E76900218AFDB10EFA5CD82AEEBBB8EF09710F144055FA55B7181DB706E49CBB1

Function 00DB172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00DB1769
_free.LIBCMT ref: 00DB1834
_free.LIBCMT ref: 00DB183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00DB1760, 00DB1767, 00DB1796, 00DB17CE

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: 069b715e4dffecbd7d86caea570bb837b97f17d7f4d523e0242a4a251189958c
Instruction ID: c0551bbc4527ea4694d153b75682f98f76e6fc1185854697d158168c5dc5bb82
Opcode Fuzzy Hash: 069b715e4dffecbd7d86caea570bb837b97f17d7f4d523e0242a4a251189958c
Instruction Fuzzy Hash: F9317079A40258FFDB21DB999885DDEBBBCEB85310F5441A6F806D7211DA708A44CBB0

Function 00DEC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00DEC306
DeleteMenu.USER32(?,00000007,00000000), ref: 00DEC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00E51990,012D5500), ref: 00DEC395

Strings

0, xrefs: 00DEC2DF

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 5b28fbbb0b90b57aca073a65dda046803f1ba32a4240c5c8f391955017ecba6b
Instruction ID: 5ffd6d32214d6c1ba250852155ccaa791d714bcdb9023fbb4ffb80d7e5923658
Opcode Fuzzy Hash: 5b28fbbb0b90b57aca073a65dda046803f1ba32a4240c5c8f391955017ecba6b
Instruction Fuzzy Hash: D1419F712143819FD720EF26D844F6ABBE8EB85320F14961DF9A5972D1D730E905CB72

Function 00E14416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00E1CC08,00000000,?,?,?,?), ref: 00E144AA
GetWindowLongW.USER32 ref: 00E144C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E144D7

Strings

SysTreeView32, xrefs: 00E1447C

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 359c4647cbcf31a7b2cb20d557a9874cff5d283677931288449fa1b69f995bba
Instruction ID: 1af0aeab28c6225a93e03134306cf8cda573c86a744582b294aad960cf89585b
Opcode Fuzzy Hash: 359c4647cbcf31a7b2cb20d557a9874cff5d283677931288449fa1b69f995bba
Instruction Fuzzy Hash: 0D318FB1210205AFDF219E38DC45BDA77A9EB08338F205715F975E22D0D770EC909760

Function 00E0304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E0335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00E03077,?,?), ref: 00E03378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00E0307A
_wcslen.LIBCMT ref: 00E0309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00E03106

Strings

255.255.255.255, xrefs: 00E03095, 00E0309A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 1ce7709e489939260d750cb32425de680c268eb3d694bfd733990627f05839d5
Instruction ID: 38683cc6a217a416433547cbad236d92f4984803d83cf1be39ee0c7944133a4e
Opcode Fuzzy Hash: 1ce7709e489939260d750cb32425de680c268eb3d694bfd733990627f05839d5
Instruction Fuzzy Hash: FC31D3392012059FCB20CF39C485EAAB7E8EF54318F249059E815AB3D2DB72EE85C770

Function 00E13EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00E13F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00E13F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00E13F78

Strings

SysMonthCal32, xrefs: 00E13F0B

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: d11531f26921fad572af295c0b79c9c170b63821b41a9a333aaf0c9d96a2b09c
Instruction ID: 41b19212138c33986dbc35edc3cb32f0d97f74ae5c34886b682085ac2885f937
Opcode Fuzzy Hash: d11531f26921fad572af295c0b79c9c170b63821b41a9a333aaf0c9d96a2b09c
Instruction Fuzzy Hash: F3219F32600219BFDF259F60DC46FEA3B75EB48728F111214FA15BB1D0D6B1E995CBA0

Function 00E14653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00E14705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00E14713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00E1471A

Strings

msctls_updown32, xrefs: 00E14684

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 2f5dd063a3629062bb7923ef96cf2af34f14fca220387d3af349d9a8bad1031d
Instruction ID: 58669ae94cd25cca86cdd4271df086e71c8604b1420a5e3aaa12c67b30160221
Opcode Fuzzy Hash: 2f5dd063a3629062bb7923ef96cf2af34f14fca220387d3af349d9a8bad1031d
Instruction Fuzzy Hash: C0215EF5600209AFDB10DF64DC81DA737ADEB8A7A8B14145AFA10AB391CB70EC51CA71

Function 00DE95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DE961D

Strings

#OnAutoItStartRegister, xrefs: 00DE95F3
#notrayicon, xrefs: 00DE95B7
#requireadmin, xrefs: 00DE95D9

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: e149dec20899a94825799c8c95b0b7c76b206a79ecefc066e6bd73680868f118
Instruction ID: 8a42383ef894b1a284ae0d7e09a1a2ca408a77812ca7166efdcb41a899c0f9d6
Opcode Fuzzy Hash: e149dec20899a94825799c8c95b0b7c76b206a79ecefc066e6bd73680868f118
Instruction Fuzzy Hash: AD215B72205690A6C731BB269C22FBBF3E8DF91310F68442AF94997041EB51DD81C3F5

Function 00E137B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00E13840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00E13850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00E13876

Strings

Listbox, xrefs: 00E1380F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: a59f106fa9aa58aca5c6c519e235f91904df37c79cac81f9fb5508a4945a6127
Instruction ID: ebea17fb9e86d325575f4927f6cf47acfc25f07847edde914fca6e7087d0ec2b
Opcode Fuzzy Hash: a59f106fa9aa58aca5c6c519e235f91904df37c79cac81f9fb5508a4945a6127
Instruction Fuzzy Hash: 4721AC72600218BBEF258F65DC81EEB376AEF89764F109125F900AB190C671DC9287A0

Function 00DF49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00DF4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00DF4A5C
SetErrorMode.KERNEL32(00000000,?,?,00E1CC08), ref: 00DF4AD0

Strings

%lu, xrefs: 00DF4A6F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: dcda8451bc1da3d30e38d40345c769ebbc01f423e36d69028b29c89711151ad2
Instruction ID: ff44129fd699f671c45df9a71beb891b2b474b7900754062af261151c5f5da84
Opcode Fuzzy Hash: dcda8451bc1da3d30e38d40345c769ebbc01f423e36d69028b29c89711151ad2
Instruction Fuzzy Hash: F1317375A40109AFDB10DF54C985EAABBF8EF05308F148099F509EB252D771ED45CB71

Function 00E141EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00E1424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00E14264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00E14271

Strings

msctls_trackbar32, xrefs: 00E14226

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 0aa3ebdcff23797fb4f3a80a7ee4746028e1d48534d4ab46e8a7e76b5104c06b
Instruction ID: cacdbfcdec0ec766b1b666c076946ad402027b787b8451c022f28d48804d54d6
Opcode Fuzzy Hash: 0aa3ebdcff23797fb4f3a80a7ee4746028e1d48534d4ab46e8a7e76b5104c06b
Instruction Fuzzy Hash: C811CE72240208BEEF205E69CC06FEB3BA8EB95B68F111524FA55F21E0D271D891DB20

Function 00DE2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D86B57: _wcslen.LIBCMT ref: 00D86B6A

Part of subcall function 00DE2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00DE2DC5
Part of subcall function 00DE2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00DE2DD6
Part of subcall function 00DE2DA7: GetCurrentThreadId.KERNEL32 ref: 00DE2DDD
Part of subcall function 00DE2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00DE2DE4

GetFocus.USER32 ref: 00DE2F78

Part of subcall function 00DE2DEE: GetParent.USER32(00000000), ref: 00DE2DF9

GetClassNameW.USER32(?,?,00000100), ref: 00DE2FC3
EnumChildWindows.USER32(?,00DE303B), ref: 00DE2FEB

Strings

%s%d, xrefs: 00DE2FFF

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 50af81e4438890d5036943518eab40f79dac1adf6865b61b05133d00a21ab771
Instruction ID: f9fa5063230ad7d9af45c5d8d17db01553244be1fdca120bd81c1ad121e38013
Opcode Fuzzy Hash: 50af81e4438890d5036943518eab40f79dac1adf6865b61b05133d00a21ab771
Instruction Fuzzy Hash: 0B11E1B16002456BCF147F718C89EFE376AEF94314F048075FA09EB292EE3099498B70

Function 00E15882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00E158C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00E158EE
DrawMenuBar.USER32(?), ref: 00E158FD

Strings

0, xrefs: 00E1588F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 84f041d4058e669f8a2c916eedefa68592b77aae6c9bad2d255802216d5f470c
Instruction ID: cbddcbb96637e19db7a00d6864504f153a98c5ab74da3cd5ef8fa1182a7f0a13
Opcode Fuzzy Hash: 84f041d4058e669f8a2c916eedefa68592b77aae6c9bad2d255802216d5f470c
Instruction Fuzzy Hash: 7C011B32500258EFDB219F11DC44BEEBBB9FB85365F148099F859E6151DB308A94DF31

Function 00DE007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ad38077deffe3d4599e0283ba4e7148c81087f5bfa68f2fb4c094fe256728c4
Instruction ID: db39b3c887b3589d526b33bd425c8a2bcb2c07aed4d39b9fedd75f50b53ac535
Opcode Fuzzy Hash: 7ad38077deffe3d4599e0283ba4e7148c81087f5bfa68f2fb4c094fe256728c4
Instruction Fuzzy Hash: 52C16C75A00246EFCB14DFA9C894EAEBBB5FF48304F248598E505EB251D771ED81CBA0

Function 00DB3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00DB3F0B
__alldvrm.LIBCMT ref: 00DB410C
__alldvrm.LIBCMT ref: 00DB412E

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 3b39d76e256ab391ab2040b5b90e04b352988323978c06ef34ea220858125007
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: BBA12576D00786DFDB15DE18C891BFEBBE5EF66390F18416DE5869B282C2348941C770

Function 00E0342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00E03459
CoUninitialize.OLE32 ref: 00E03463
VariantInit.OLEAUT32(?), ref: 00E0346E
VariantClear.OLEAUT32(?), ref: 00E0371B

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: efd48fc8168a04ec62b95b01d74c216e8b648ccaf51319c5b456a7a5396f192c
Instruction ID: 7dfb6b3cbd1caaa3b392e8fcb17198734d8ecb37e6205f917ded9893101728a8
Opcode Fuzzy Hash: efd48fc8168a04ec62b95b01d74c216e8b648ccaf51319c5b456a7a5396f192c
Instruction Fuzzy Hash: 48A14E756043009FC700EF28C585A6AB7E9FF88714F148859F99AAB3A2DB31ED45CB61

Function 00DE0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00E1FC08,?), ref: 00DE05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00E1FC08,?), ref: 00DE0608
CLSIDFromProgID.OLE32(?,?,00000000,00E1CC40,000000FF,?,00000000,00000800,00000000,?,00E1FC08,?), ref: 00DE062D
_memcmp.LIBVCRUNTIME ref: 00DE064E

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 33e23f12e10da0b5ffd4ab1ff0119881f463db3d22417cb260d1834e72c18445
Instruction ID: 1d75b214acba8e1d569309d0fa2f58e8512216f187636ce1a9d74ff41f1cc242
Opcode Fuzzy Hash: 33e23f12e10da0b5ffd4ab1ff0119881f463db3d22417cb260d1834e72c18445
Instruction Fuzzy Hash: 54812971A00209EFCB04DF95C984EEEBBB9FF89315F244558E506AB250DB71AE46CB60

Function 00DC1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00DC14C0

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 23b5b4a46994906c4d8405bfd880966e7e29ddf39edb040f9255e1aa8db5f175
Instruction ID: 3d4b98bd146c8740c2786131187428a37d6d107c148d6edb3e2d9cd0ff3f97f6
Opcode Fuzzy Hash: 23b5b4a46994906c4d8405bfd880966e7e29ddf39edb040f9255e1aa8db5f175
Instruction Fuzzy Hash: AF415E39544122ABDB297BF98C45FBE3AA5EF43370F28426DF419D3293E63488415271

Function 00E16278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00E162E2
ScreenToClient.USER32(?,?), ref: 00E16315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00E16382

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 1fddd88483ef007e26b9d05b2a51be3b43d2d725477548f6d32139568a1f12f0
Instruction ID: ab9e0c17682df66fe1863df0af4454fcb5f4a77d582badecd9694adc8b2cbdc7
Opcode Fuzzy Hash: 1fddd88483ef007e26b9d05b2a51be3b43d2d725477548f6d32139568a1f12f0
Instruction Fuzzy Hash: 2B512C74A00209AFDF14DF68D880AEE7BB5FB95364F109559F825AB2A0D770ED81CB50

Function 00E01AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00E01AFD
WSAGetLastError.WSOCK32 ref: 00E01B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00E01B8A
WSAGetLastError.WSOCK32 ref: 00E01B94

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 51b42b8c017db2fbc4da6dc47f45c844a210fd929b247d43074410c08f7310bc
Instruction ID: 743a942fcd000152ee6715e923891ef8ee7562fdc05734cc8152c8ed2b538f24
Opcode Fuzzy Hash: 51b42b8c017db2fbc4da6dc47f45c844a210fd929b247d43074410c08f7310bc
Instruction Fuzzy Hash: D3417174640200AFE720AF24D886F6977E5EF44718F548498FA1A9F7D2D772ED818BA0

Function 00DBB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4741a53285f4885ab38734cb693913e2ca5bb356d6f451f9a7e8fe697a4b7d10
Instruction ID: 3cfc7f0e47b998b8d7a54e15d34bf94c509f67a2d95d960f64bad17c1f787f88
Opcode Fuzzy Hash: 4741a53285f4885ab38734cb693913e2ca5bb356d6f451f9a7e8fe697a4b7d10
Instruction Fuzzy Hash: 9B41E676A00714EFD7249F78CC41BAABBE9EB89724F10456FF146DB282D7B1990187B0

Function 00DF56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00DF5783
GetLastError.KERNEL32(?,00000000), ref: 00DF57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00DF57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00DF57FA

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 481a2683b6001b075e06d5f4e0f5f9f222cf47ca6c71c638fc4c7d761d96ccde
Instruction ID: 51711e5fa54a10a09c79d6fd2ddbe1d6be058e7ec331945a3583c09606010207
Opcode Fuzzy Hash: 481a2683b6001b075e06d5f4e0f5f9f222cf47ca6c71c638fc4c7d761d96ccde
Instruction Fuzzy Hash: D4412C35600610DFCB11EF15C444A5DBBE1EF89720B19C488E95AAB366CB30FD40CBB1

Function 00DBD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00DA6D71,00000000,00000000,00DA82D9,?,00DA82D9,?,00000001,00DA6D71,8BE85006,00000001,00DA82D9,00DA82D9), ref: 00DBD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DBD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00DBD9AB
__freea.LIBCMT ref: 00DBD9B4

Part of subcall function 00DB3820: RtlAllocateHeap.NTDLL(00000000,?,00E51444,?,00D9FDF5,?,?,00D8A976,00000010,00E51440,00D813FC,?,00D813C6,?,00D81129), ref: 00DB3852

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 0b1c18499a20396068c8b57a1d2fe2af562140c0d5da8793aecf694bb2ae92e4
Instruction ID: f6bc4006e90da021a827bf2a1388097ce2d74fa07d0ccb756720823f60d742df
Opcode Fuzzy Hash: 0b1c18499a20396068c8b57a1d2fe2af562140c0d5da8793aecf694bb2ae92e4
Instruction Fuzzy Hash: 7931AB72A0020AEBDF249F65DC41EEE7BA6EB41310B194168FC06E7250EB35DD54CBB0

Function 00E152C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00E15352
GetWindowLongW.USER32(?,000000F0), ref: 00E15375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E15382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00E153A8

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 90248b1b24bf89a58dd64b6218acbd4e17db51b47dbec4a1a807e5393cf2b031
Instruction ID: ea46e469382026d3d94b9322f1b3045008179e96791240e0da136cee38171381
Opcode Fuzzy Hash: 90248b1b24bf89a58dd64b6218acbd4e17db51b47dbec4a1a807e5393cf2b031
Instruction Fuzzy Hash: CE31E572A55A08EFEB349F14CC05BE83761AB84394F986502FA31B71E4C7B09DC0AB52

Function 00DEAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00DEABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00DEAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00DEAC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00DEACC6

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 0c706ddf7d2f5983fba72616a1c89f9d861c077688c8c44a9277c74affe52127
Instruction ID: 97705b17fe1b539a279f611ec876a4b1cedfad718b4293557376b3bee835c8b4
Opcode Fuzzy Hash: 0c706ddf7d2f5983fba72616a1c89f9d861c077688c8c44a9277c74affe52127
Instruction Fuzzy Hash: C3312A34A4079A6FEF35EB6B8C047FE7BA5AB85710F2C421AE485921D0C374A9858773

Function 00E17674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00E1769A
GetWindowRect.USER32(?,?), ref: 00E17710
PtInRect.USER32(?,?,00E18B89), ref: 00E17720
MessageBeep.USER32(00000000), ref: 00E1778C

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 9b7d2729ef0ccdc81943863a0bb0f63269670d56db66990bbcbca7315830e345
Instruction ID: 24ff52b008bc199bd1219c185f253ae07b65e7f4235f10dece00be2cf22be475
Opcode Fuzzy Hash: 9b7d2729ef0ccdc81943863a0bb0f63269670d56db66990bbcbca7315830e345
Instruction Fuzzy Hash: 8D41AF74609214DFCB01CF59C894EE9B7F5FB49B16F1490AAE494EB2A1C330E985CF90

Function 00E116DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00E116EB

Part of subcall function 00DE3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00DE3A57
Part of subcall function 00DE3A3D: GetCurrentThreadId.KERNEL32 ref: 00DE3A5E
Part of subcall function 00DE3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00DE25B3), ref: 00DE3A65

GetCaretPos.USER32(?), ref: 00E116FF
ClientToScreen.USER32(00000000,?), ref: 00E1174C
GetForegroundWindow.USER32 ref: 00E11752

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: d18a483820d4774fcfcf0784985918fd9ed675dc42e4fa98eee6c634ee8ff0bd
Instruction ID: c602063733c8630d6683f4cd69c9a2cd7a79830aa1194d968109f3f5861d56dc
Opcode Fuzzy Hash: d18a483820d4774fcfcf0784985918fd9ed675dc42e4fa98eee6c634ee8ff0bd
Instruction Fuzzy Hash: 8B315071D00149AFD704EFAAC881CEEBBF9EF48304B5080AAE515E7251D631DE45CBB1

Function 00DEDF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00D87620: _wcslen.LIBCMT ref: 00D87625

_wcslen.LIBCMT ref: 00DEDFCB
_wcslen.LIBCMT ref: 00DEDFE2
_wcslen.LIBCMT ref: 00DEE00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00DEE018

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 24bed3847224c3836e47ef6951ff09d1a34efb6ec93138017a3026c1bb9a7c15
Instruction ID: 52913fd301723c2b887612998b524ef3f76a4b8b34fa952b2434f5987b252c77
Opcode Fuzzy Hash: 24bed3847224c3836e47ef6951ff09d1a34efb6ec93138017a3026c1bb9a7c15
Instruction Fuzzy Hash: 08218371900214AFCB10EFA9D982BAEB7F8EF86760F184065E805BB245D6709E418BB1

Function 00DED4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00DED501
Process32FirstW.KERNEL32(00000000,?), ref: 00DED50F
Process32NextW.KERNEL32(00000000,?), ref: 00DED52F
CloseHandle.KERNEL32(00000000), ref: 00DED5DC

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ecc0a5b51360b7fa9dc245638a9e6cf40eea819c375285c982e0c2aae3a1daa4
Instruction ID: 10c6b286296640b7acf45a75f74244bd46367c61907f7cb16449d52a5f9f5833
Opcode Fuzzy Hash: ecc0a5b51360b7fa9dc245638a9e6cf40eea819c375285c982e0c2aae3a1daa4
Instruction Fuzzy Hash: A2319C71108340AFD300FF55C885AAFBBF8EF99354F18092DF581921A1EB719A48CBB2

Function 00E18FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D99BB2

GetCursorPos.USER32(?), ref: 00E19001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00DD7711,?,?,?,?,?), ref: 00E19016
GetCursorPos.USER32(?), ref: 00E1905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00DD7711,?,?,?), ref: 00E19094

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: a07cd0a180ee8f2695647c36cd4824fc7ebdbf13670254125f20e9e9fc5dfea4
Instruction ID: 1b57e555043c15845d3c5741734139ebdcc1f1e8c692f610ba211a27b0f1b02a
Opcode Fuzzy Hash: a07cd0a180ee8f2695647c36cd4824fc7ebdbf13670254125f20e9e9fc5dfea4
Instruction Fuzzy Hash: 3B219F35600118EFCB25CF95CC68EEA7BB9EB89361F144069F905A72A2C3759DD0DB60

Function 00DED2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00E1CB68), ref: 00DED2FB
GetLastError.KERNEL32 ref: 00DED30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00DED319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00E1CB68), ref: 00DED376

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: d007b36ef655108f375540cffcf4b5fe73701844b9c16f7d5a43492303653539
Instruction ID: c0ddf6ec9adf17c5b53dcf1e75979ceeafc43d203ff3842981091f82e80b7b77
Opcode Fuzzy Hash: d007b36ef655108f375540cffcf4b5fe73701844b9c16f7d5a43492303653539
Instruction Fuzzy Hash: 8B219F745083419F8310EF2AC8818AEB7E4EF56724F244A1DF499D72E1DB30D94ACBA3

Function 00DE1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00DE102A
Part of subcall function 00DE1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00DE1036
Part of subcall function 00DE1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DE1045
Part of subcall function 00DE1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00DE104C
Part of subcall function 00DE1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DE1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00DE15BE
_memcmp.LIBVCRUNTIME ref: 00DE15E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DE1617
HeapFree.KERNEL32(00000000), ref: 00DE161E

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: dc1ee612f090356986fdb63fe2f610288ae06e3d49b2ad77c89461c1b4a75b56
Instruction ID: aa6a2ebcf88a3c69168452f6b81c261edf2343e24745bfee7b9959f3d0d1690b
Opcode Fuzzy Hash: dc1ee612f090356986fdb63fe2f610288ae06e3d49b2ad77c89461c1b4a75b56
Instruction Fuzzy Hash: 65219A35F40208EFDF00EFA6C945BEEB7B8EF44354F188459E445AB241E730AA49CBA0

Function 00E12782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00E1280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00E12824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00E12832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00E12840

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 32a0620b79ac32f2e65469c2c1a2a164643caa4cc3d3f130ba9abdb5d6a3b5f0
Instruction ID: b1bb0da5d71f2464673d86e9fe39d1aae2e8ce5da4b13d26b10d24380d9f00ac
Opcode Fuzzy Hash: 32a0620b79ac32f2e65469c2c1a2a164643caa4cc3d3f130ba9abdb5d6a3b5f0
Instruction Fuzzy Hash: C221BD31204111AFD7149B24CC44FEA7B96EF85328F24815DF526EB6E2CB71EC92CBA0

Function 00DE78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00DE790A,?,000000FF,?,00DE8754,00000000,?,0000001C,?,?), ref: 00DE8D8C
Part of subcall function 00DE8D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00DE8DB2
Part of subcall function 00DE8D7D: lstrcmpiW.KERNEL32(00000000,?,00DE790A,?,000000FF,?,00DE8754,00000000,?,0000001C,?,?), ref: 00DE8DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00DE8754,00000000,?,0000001C,?,?,00000000), ref: 00DE7923
lstrcpyW.KERNEL32(00000000,?), ref: 00DE7949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00DE8754,00000000,?,0000001C,?,?,00000000), ref: 00DE7984

Strings

cdecl, xrefs: 00DE797B

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 598df18a80586a4e91c846eec69e6fb520e06177aca06a859f809d1a9a247d92
Instruction ID: f025097960f7fdbeea184932643b96c3aeff37794a8ce4096e3218142463795d
Opcode Fuzzy Hash: 598df18a80586a4e91c846eec69e6fb520e06177aca06a859f809d1a9a247d92
Instruction Fuzzy Hash: 7A11D63A200381AFCB156F36DC45E7A77A5FF45350B54802AF946C7265EB319811DB71

Function 00E17CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00E17D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00E17D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00E17D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00DFB7AD,00000000), ref: 00E17D6B

Part of subcall function 00D99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D99BB2

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 0e46e0d3bbbb3319af13d7adedf1fbffeb2728c7f2ba42a92c58c252077fcb17
Instruction ID: 38da175b77112daf2ac7a7b63f5408dede28c8e3e5b6d078e71c905d786335bf
Opcode Fuzzy Hash: 0e46e0d3bbbb3319af13d7adedf1fbffeb2728c7f2ba42a92c58c252077fcb17
Instruction Fuzzy Hash: D611D231204618AFCB108F29DC04AEA3BB5AF46768B219724F875E72F0D7308994CB90

Function 00E15660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00E156BB
_wcslen.LIBCMT ref: 00E156CD
_wcslen.LIBCMT ref: 00E156D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00E15816

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 3d31f0c7a5dce06cc39ec22738e38d4a7f7bcb56fa2b4d244ece8e2cfbb53162
Instruction ID: 2c76d39524978332e00e8d6d8a4fbb7ab30f50e0b9ba8e21b495ebf6af918a80
Opcode Fuzzy Hash: 3d31f0c7a5dce06cc39ec22738e38d4a7f7bcb56fa2b4d244ece8e2cfbb53162
Instruction Fuzzy Hash: 5911B472600604DADB209F65CC85AEE77ACEF95768B50502AF916F6081E77089C4CF61

Function 00DB1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 974ecf4768e593d18abb2385bc2093fb8a14a2076f152ed1319776b895c94399
Instruction ID: 514145e64d018d2985cd7d57ee205d1f98f9028e3d5cc893abdfbf24ce3f02fd
Opcode Fuzzy Hash: 974ecf4768e593d18abb2385bc2093fb8a14a2076f152ed1319776b895c94399
Instruction Fuzzy Hash: F901D1B624A61AFEFA212A796CD0FE7662DDF817B8F780725F523A11D2DB60CC014170

Function 00DE1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00DE1A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00DE1A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00DE1A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00DE1A8A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 14a300ea9fa069732f888f6367d5a1a8eb1ae49e64f89d53f832cbf4b3c4156e
Instruction ID: 620a09c965431b16ec99e4a69286a4dc1c3d1d79c28d04ddad9dd6b5c974d06d
Opcode Fuzzy Hash: 14a300ea9fa069732f888f6367d5a1a8eb1ae49e64f89d53f832cbf4b3c4156e
Instruction Fuzzy Hash: 95113C3AE01219FFEB10DBA5CD85FADBB78EB04750F2000A1E605B7290D6716E51DBA4

Function 00DEE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00DEE1FD
MessageBoxW.USER32(?,?,?,?), ref: 00DEE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00DEE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00DEE24D

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: ca0512d9d2cf1486d5f4ec42dbdba5ca1864383216163c5821382d88ad6c74aa
Instruction ID: 7e3237211958732a50c993fb1366637516c67ad1a909000f1a048bd21af0e79e
Opcode Fuzzy Hash: ca0512d9d2cf1486d5f4ec42dbdba5ca1864383216163c5821382d88ad6c74aa
Instruction Fuzzy Hash: 9D110876904254BFC705AFAA9C05BDE7FAD9B45315F148655F924F3291D2B0C90887B0

Function 00DAD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00DACFF9,00000000,00000004,00000000), ref: 00DAD218
GetLastError.KERNEL32 ref: 00DAD224
__dosmaperr.LIBCMT ref: 00DAD22B
ResumeThread.KERNEL32(00000000), ref: 00DAD249

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 826438545b7b6e832a9bca720571e254d1ea6ed51185c2f9059e74d6146ccfaf
Instruction ID: 6a61acf5dc706df288d715c8f3cfe5315435ca3ce2d5ce1da90359e9afaba2b0
Opcode Fuzzy Hash: 826438545b7b6e832a9bca720571e254d1ea6ed51185c2f9059e74d6146ccfaf
Instruction Fuzzy Hash: 0C012676405204BFC7106FA5DC09BAE7A6ADF83330F204258F826D60D0CF70C805C6B0

Function 00E19EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00D99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D99BB2

GetClientRect.USER32(?,?), ref: 00E19F31
GetCursorPos.USER32(?), ref: 00E19F3B
ScreenToClient.USER32(?,?), ref: 00E19F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00E19F7A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 0c39ebcd2bb52122aa520cebaf1e87e0a472173f8e88f6ff5bd49f9d66fc839e
Instruction ID: 6e959e1ea81f506d4384fa5a23c2d36db8927b9f61f660a95122d7b0393b681a
Opcode Fuzzy Hash: 0c39ebcd2bb52122aa520cebaf1e87e0a472173f8e88f6ff5bd49f9d66fc839e
Instruction Fuzzy Hash: 88112232A0021ABBDB109FA9C8999FE77B9EB49315F504455F911F3142D330AAC6CBA1

Function 00D8600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00D8604C
GetStockObject.GDI32(00000011), ref: 00D86060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00D8606A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 3faef48b7d7663c9d143558a73b39b17e7e61b2a890681285103471f0f1ed327
Instruction ID: a3073ecc3ab854b13175bd83cec7d29617d0a03aded63d4fc71b970acd857480
Opcode Fuzzy Hash: 3faef48b7d7663c9d143558a73b39b17e7e61b2a890681285103471f0f1ed327
Instruction Fuzzy Hash: 9F11ADB2101508BFEF125FA58C44EEABB69EF083A4F144206FA04A2110C772DC60DBA1

Function 00DA3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00DA3B56

Part of subcall function 00DA3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00DA3AD2
Part of subcall function 00DA3AA3: ___AdjustPointer.LIBCMT ref: 00DA3AED

_UnwindNestedFrames.LIBCMT ref: 00DA3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00DA3B7C
CallCatchBlock.LIBVCRUNTIME ref: 00DA3BA4

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: e0bf27d95329b3846cf8fd31a19ce2f2c9f3876a38a076d9cd395851a8fae71b
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: C1012532100148BBDF126F95DC42EEB7F6AEF9A754F044018FE48A6121C776E961EBB0

Function 00DB3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00D813C6,00000000,00000000,?,00DB301A,00D813C6,00000000,00000000,00000000,?,00DB328B,00000006,FlsSetValue), ref: 00DB30A5
GetLastError.KERNEL32(?,00DB301A,00D813C6,00000000,00000000,00000000,?,00DB328B,00000006,FlsSetValue,00E22290,FlsSetValue,00000000,00000364,?,00DB2E46), ref: 00DB30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00DB301A,00D813C6,00000000,00000000,00000000,?,00DB328B,00000006,FlsSetValue,00E22290,FlsSetValue,00000000), ref: 00DB30BF

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 2475352ec9eb3f11bd404a7036112a44bb8bd299cab6cb2efc050677d8f41d36
Instruction ID: 88f95e8e471996a457a0bde44d391118703296fd26c14e7481e5d05d145498c8
Opcode Fuzzy Hash: 2475352ec9eb3f11bd404a7036112a44bb8bd299cab6cb2efc050677d8f41d36
Instruction Fuzzy Hash: F801D436745622EFCB315E7EAC44AD77B98AF05BA1B244620F907E3190CB21DA45D6F0

Function 00DE7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00DE747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00DE7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00DE74AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00DE74CA

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 763cf5876de7043b65c39a3b798acb0eb93b9aa1cfd7e66f6f9ff356f2096fc6
Instruction ID: 1aa5c30c997d995fc6f3dde4d86d22ef99f4b02fcb0aab46b4858cfcbf278d9b
Opcode Fuzzy Hash: 763cf5876de7043b65c39a3b798acb0eb93b9aa1cfd7e66f6f9ff356f2096fc6
Instruction Fuzzy Hash: 4A11C4B5249354AFE720AF16DC08F967FFCEB00B04F108569A666D6191D770E908DB60

Function 00DEB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00DEACD3,?,00008000), ref: 00DEB0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00DEACD3,?,00008000), ref: 00DEB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00DEACD3,?,00008000), ref: 00DEB0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00DEACD3,?,00008000), ref: 00DEB126

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 963cf49fafcf93f0a6d91d73ec6b1b4bb7059616dc1a9432d4abe36b01e07c18
Instruction ID: 12362bfa256a3e102de6fffb3121c56b68ed2a4fac08ecfc63d15bac234ca870
Opcode Fuzzy Hash: 963cf49fafcf93f0a6d91d73ec6b1b4bb7059616dc1a9432d4abe36b01e07c18
Instruction Fuzzy Hash: 9E116131D4166CEBCF00AFE6E9587EFBB78FF0A721F104086D941B2141CB30A5549B61

Function 00E17E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00E17E33
ScreenToClient.USER32(?,?), ref: 00E17E4B
ScreenToClient.USER32(?,?), ref: 00E17E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E17E8A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: d7a3387befbffa8cb4f186a2cc35026345fbca8fbe746186bc571c526808ed77
Instruction ID: ad3c5a1c3c1f68f6e4de3fd3ad08d5ddc80c8d783178a3229593955ee444552d
Opcode Fuzzy Hash: d7a3387befbffa8cb4f186a2cc35026345fbca8fbe746186bc571c526808ed77
Instruction Fuzzy Hash: 601156B9D0020AAFDB41CFA9C8849EEBBF5FF08310F509066E915E3210D775AA54CF50

Function 00DE2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00DE2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00DE2DD6
GetCurrentThreadId.KERNEL32 ref: 00DE2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00DE2DE4

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 0207c90ff01d923ac847c9a0d09258e0d3c0c49239a4668e0002065115e889aa
Instruction ID: 54fd5c43d8f4e73a249299941bc2c747d18fc81b366a47e9444548ba5fbad77f
Opcode Fuzzy Hash: 0207c90ff01d923ac847c9a0d09258e0d3c0c49239a4668e0002065115e889aa
Instruction Fuzzy Hash: 14E06D716812247AD7202B639C0DEFB3E6CEB42FA1F144115B206E1080DAA4C884C6F0

Function 00E18863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00D99639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D99693
Part of subcall function 00D99639: SelectObject.GDI32(?,00000000), ref: 00D996A2
Part of subcall function 00D99639: BeginPath.GDI32(?), ref: 00D996B9
Part of subcall function 00D99639: SelectObject.GDI32(?,00000000), ref: 00D996E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00E18887
LineTo.GDI32(?,?,?), ref: 00E18894
EndPath.GDI32(?), ref: 00E188A4
StrokePath.GDI32(?), ref: 00E188B2

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: ef2baa77282b477bc78561c3cb335f190c56754c7ae090b71e885d828a95d5ec
Instruction ID: f6cdee538b81e7e3849616a34dc6ecefb1a706315c6e04f77826f8ec2da70edb
Opcode Fuzzy Hash: ef2baa77282b477bc78561c3cb335f190c56754c7ae090b71e885d828a95d5ec
Instruction Fuzzy Hash: B6F05E36081258FEDB125F95AC0AFCE3F69AF0A311F548040FA11B50E1C7755555CFE9

Function 00D998B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00D998CC
SetTextColor.GDI32(?,?), ref: 00D998D6
SetBkMode.GDI32(?,00000001), ref: 00D998E9
GetStockObject.GDI32(00000005), ref: 00D998F1

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 8d7759996fb3249db5bc70327340957c132b30a8a9fc2851f4b773c4b17e59ff
Instruction ID: 9b22c251856fcbc76a9264ba732508e19afe3fcf693ea96a637c51395df5a497
Opcode Fuzzy Hash: 8d7759996fb3249db5bc70327340957c132b30a8a9fc2851f4b773c4b17e59ff
Instruction Fuzzy Hash: E5E065313C4240BEDB215F75BC09BD87F21AB11335F28C21AF6F9A40E1C37146449B21

Function 00DE162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00DE1634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00DE11D9), ref: 00DE163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00DE11D9), ref: 00DE1648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00DE11D9), ref: 00DE164F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 22940067cba70826ee26344ee784f40c5dd1712700bc3567f3e79a6edbef81cf
Instruction ID: 831f04de5abfb4cdda63c378f2e5f934431f504a221adb800da908810cdd7dbe
Opcode Fuzzy Hash: 22940067cba70826ee26344ee784f40c5dd1712700bc3567f3e79a6edbef81cf
Instruction Fuzzy Hash: 09E08675641211DFD7202FA29D0DBC63B7CBF44791F28C808F245E9090E6344549C760

Function 00DDD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00DDD858
GetDC.USER32(00000000), ref: 00DDD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DDD882
ReleaseDC.USER32(?), ref: 00DDD8A3

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 463ab51375df2135d3e86cdc983611617734303c6f668b53ba9cd5906e4904ae
Instruction ID: 11541994075070309b1b669e82561081c1317bfecf7690bc9fc81233d30b6a4d
Opcode Fuzzy Hash: 463ab51375df2135d3e86cdc983611617734303c6f668b53ba9cd5906e4904ae
Instruction Fuzzy Hash: ECE01AB4840204EFCF41AFA1D8086ADBBB2FF08710F20D009E84AF7250C7388906AF60

Function 00DDD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00DDD86C
GetDC.USER32(00000000), ref: 00DDD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DDD882
ReleaseDC.USER32(?), ref: 00DDD8A3

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 0a6692b8ef2b8240bfbb31e46d348e17c1b8a9feb64c022c51eec8b1ef253204
Instruction ID: 6a14ac772157ad8ae6170c14b66e6a69d9717e9070e60a1139960bc15f56cea6
Opcode Fuzzy Hash: 0a6692b8ef2b8240bfbb31e46d348e17c1b8a9feb64c022c51eec8b1ef253204
Instruction Fuzzy Hash: 4BE09AB5C40204DFCF51AFA1D8086ADBBB5FF48715B249449E94AF7250C73859069F60

Function 00DF4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00D87620: _wcslen.LIBCMT ref: 00D87625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00DF4ED4

Strings

*, xrefs: 00DF4E10
LPT, xrefs: 00DF4DFB

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: b81966e25e0a1c72c7ddd26540e77704d4228230a79340f9100e45944690db9c
Instruction ID: 133283b0f5c1181963383f42a04cee48c566f5e382c5077eb21d3038c411900a
Opcode Fuzzy Hash: b81966e25e0a1c72c7ddd26540e77704d4228230a79340f9100e45944690db9c
Instruction Fuzzy Hash: 5D914B75A002089FCB14DF58C484EAABBF1AF45314F19C099E94A9F362D731EE85CBA1

Function 00DAE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00DAE30D

Strings

pow, xrefs: 00DAE2E5, 00DAE302

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 0e4809c4c4da9aa56124ae63357acc30d5dacd16cb4292ae38b226382aa95821
Instruction ID: 34201436ecd22b034c4bfe60bc61180cec6906e6f7542fc69197dbb3ae4e0dc1
Opcode Fuzzy Hash: 0e4809c4c4da9aa56124ae63357acc30d5dacd16cb4292ae38b226382aa95821
Instruction Fuzzy Hash: 14511861A0C202DBDB257724C9413F93BA4EF81781F28499CF0D7922E9EB35CC95DA76

Function 00E07771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(00DD569E,00000000,?,00E1CC08,?,00000000,00000000), ref: 00E078DD

Part of subcall function 00D86B57: _wcslen.LIBCMT ref: 00D86B6A

CharUpperBuffW.USER32(00DD569E,00000000,?,00E1CC08,00000000,?,00000000,00000000), ref: 00E0783B

Strings

<s, xrefs: 00E0790C, 00E0790F, 00E07924

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <s
API String ID: 3544283678-2940880691
Opcode ID: d38fad3b11c442564d4249dded69b6118d9891feffc35bc77bf39fb3c241020a
Instruction ID: d53e5adfa73e6a978aa5afc07bbfc6d0476576e724092b1827538bd529367ea5
Opcode Fuzzy Hash: d38fad3b11c442564d4249dded69b6118d9891feffc35bc77bf39fb3c241020a
Instruction Fuzzy Hash: AF611B76914129AACF04FBA4CC91DFDB378FF54704B54512AE582B7091EF34AA49CBB0

Function 00D9E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00D9E1B1

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: bdf63d9bfee222253ab8dd593e709af96826a2cab03bad007f6eeeaa1da3079e
Instruction ID: 81c4e1edeb50a3751b4ece6df0e0d23eeea157ed4e46bde2837575c5871fabc7
Opcode Fuzzy Hash: bdf63d9bfee222253ab8dd593e709af96826a2cab03bad007f6eeeaa1da3079e
Instruction Fuzzy Hash: 9E51CF75904246EFDF19EF68C481AFA7BA9EF65310F28405AE8919F290D634DD42CBB0

Function 00D9F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00D9F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00D9F2BB

Strings

@, xrefs: 00D9F2AF

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: bc509f3017e624b7c9c0d8bbb04dd373c9f04d86f35df00b7a1f7face0e552cd
Instruction ID: b051955b6dc82a7647802f0efff475af4b77c3a03c173ed3163d6cac4d972b3b
Opcode Fuzzy Hash: bc509f3017e624b7c9c0d8bbb04dd373c9f04d86f35df00b7a1f7face0e552cd
Instruction Fuzzy Hash: 735128714187489BE320AF11E886BAFBBF8FF84304F91885DF19951195EB708529CB76

Function 00E05745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00E057E0
_wcslen.LIBCMT ref: 00E057EC

Strings

CALLARGARRAY, xrefs: 00E057E6, 00E057EB

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 6c35b3c1df65214d432f864941411553e271882382cf724eaf6acb2a64c62e4c
Instruction ID: dcf9b99b0e5434e6cdd2a079d31505763d1518a726d02674c256223dbe100002
Opcode Fuzzy Hash: 6c35b3c1df65214d432f864941411553e271882382cf724eaf6acb2a64c62e4c
Instruction Fuzzy Hash: 5E418232A001099FCB08DFA9C8828BEBBB5EF59314F149069E905B7291E730DD81CFB0

Function 00DFD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DFD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00DFD13A

Strings

|, xrefs: 00DFD10B

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 84f364026fb5cc02161ee7dec5731f35dc671be7fae0c81e70873541e2d4d924
Instruction ID: 473211a8724e49dd6333a90863f547a4ae944efb7c96344bd9a7c55272c0dcac
Opcode Fuzzy Hash: 84f364026fb5cc02161ee7dec5731f35dc671be7fae0c81e70873541e2d4d924
Instruction Fuzzy Hash: DF312A71D00209ABCF15EFA5CC85AEEBFBAFF05310F104019F915A6166E731AA16DB70

Function 00E1356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00E13621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00E1365C

Strings

static, xrefs: 00E135BC

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: c80c19c1197700b6807ff98b66122f3651c5f7b47b032604ab5c7f0fe1d5b66a
Instruction ID: 7ad9fb1166bc5e198179dde53873c40f841e00c3cbdcfbfc152d2f7d3ec82888
Opcode Fuzzy Hash: c80c19c1197700b6807ff98b66122f3651c5f7b47b032604ab5c7f0fe1d5b66a
Instruction Fuzzy Hash: CB319E71110204AEDB24DF38DC80EFB73A9FF88764F10A619F9A5E7280DA30AD91C760

Function 00E14537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00E1461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E14634

Strings

', xrefs: 00E1458E

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: b871a881e69741fc6647adcf291a6631a4c0f07f2f56f0009e008df22f347315
Instruction ID: dfcf3d7f7ea187cb7d0ae73d990b10e7c544a8492b1719c81266ebaf14e4d777
Opcode Fuzzy Hash: b871a881e69741fc6647adcf291a6631a4c0f07f2f56f0009e008df22f347315
Instruction Fuzzy Hash: 493118B5A0130A9FDB14CFA9C990BDA7BB6FF49304F14506AE905AB391D770A981CF90

Function 00E131EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00E1327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E13287

Strings

Combobox, xrefs: 00E13249

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 68c8e6d1c262d2e4bf4ee011f0a8a9d8d29322e83241295f0f44a538e983d860
Instruction ID: a90d0ed10c89518e9f7c6f832e610bd96d3a1a5d673e215e2d36fd24508da33f
Opcode Fuzzy Hash: 68c8e6d1c262d2e4bf4ee011f0a8a9d8d29322e83241295f0f44a538e983d860
Instruction Fuzzy Hash: EC11B6713002087FEF25AE64DC80EFB375BEB54368F105524F915B72A0D6319D91C760

Function 00E13710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00D8600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00D8604C
Part of subcall function 00D8600E: GetStockObject.GDI32(00000011), ref: 00D86060
Part of subcall function 00D8600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D8606A

GetWindowRect.USER32(00000000,?), ref: 00E1377A
GetSysColor.USER32(00000012), ref: 00E13794

Strings

static, xrefs: 00E13757

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 72bf7d3dc2f76cd8379b5d7f73eb0a0f68abd6bf58954887096465c8e1790e69
Instruction ID: e211f4ae3f6c5ffa57dbec76fcc5f4ad7512f63a46af656713efe0de643035b8
Opcode Fuzzy Hash: 72bf7d3dc2f76cd8379b5d7f73eb0a0f68abd6bf58954887096465c8e1790e69
Instruction Fuzzy Hash: A41137B2610209AFDF01DFB8CC46EEA7BF9FB08314F105925F955E2250E735E8559B60

Function 00DFCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00DFCD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00DFCDA6

Strings

<local>, xrefs: 00DFCD66

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 8983d01c752fd04bf65ae4bb00151d1412fd4cff517be483ef61de249fd40d8f
Instruction ID: cc6254050191e76d368e01805a64dffcf9f6b7329f477ab87c2b12908cf3cd40
Opcode Fuzzy Hash: 8983d01c752fd04bf65ae4bb00151d1412fd4cff517be483ef61de249fd40d8f
Instruction Fuzzy Hash: CB11067122163DBAD7344B669C44EFBBEACEF127A4F019226B24993080D3709855D6F0

Function 00E13429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00E134AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00E134BA

Strings

edit, xrefs: 00E1348F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: e097ed4c1d26ad8d01d8dcd0a5806ef121cac7fcc0185475df509dfee69da780
Instruction ID: 8c1e4885685e140f6b1631ba184585fcd617a849bcaabae19f4a782e4b3b7fa0
Opcode Fuzzy Hash: e097ed4c1d26ad8d01d8dcd0a5806ef121cac7fcc0185475df509dfee69da780
Instruction Fuzzy Hash: 31118C71100208AFEB228E74DC44AEB37AAEB15778F606724FA75E31E0C771DC959B61

Function 00DE6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

CharUpperBuffW.USER32(?,?,?), ref: 00DE6CB6
_wcslen.LIBCMT ref: 00DE6CC2

Strings

STOP, xrefs: 00DE6CBC, 00DE6CC1

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 3ee7835247775b4b21d25e017f4ec4d3de16c77b9023f99bc108dce50d455b04
Instruction ID: 4a21ac253daf4c95ef516fc733483fe53f81a6c52821bc8f91753bbf30f949a1
Opcode Fuzzy Hash: 3ee7835247775b4b21d25e017f4ec4d3de16c77b9023f99bc108dce50d455b04
Instruction Fuzzy Hash: 630104326005668BCB20BFBEDC908BF77B5FB717907640528E85292191EB31D840C770

Function 00DE1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

Part of subcall function 00DE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DE3CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00DE1D4C

Strings

ListBox, xrefs: 00DE1D16
ComboBox, xrefs: 00DE1CEB

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 826482877aa1180d00e28fbed5bdf494469c6315cac8154b30bcde0a0de55cb9
Instruction ID: 3da35df0a79cc4d7794a5e52bcf5da3efc4c2342e5e6eab4a86b7bb89d3b2f30
Opcode Fuzzy Hash: 826482877aa1180d00e28fbed5bdf494469c6315cac8154b30bcde0a0de55cb9
Instruction Fuzzy Hash: A801D875701258ABCB14FBA5CC55CFEB368EB46350B180519F872672C1EA3199088770

Function 00DE1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

Part of subcall function 00DE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DE3CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00DE1C46

Strings

ListBox, xrefs: 00DE1C10
ComboBox, xrefs: 00DE1BE5

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 2dcf646c73004063db66cd2b7d27163b7c91d60bf3835bc98e2972f73a435419
Instruction ID: 8b68e62e2a43c91538e9f8e570a30f919a49eb4c51b0d4b40ce7de4bff2c59f2
Opcode Fuzzy Hash: 2dcf646c73004063db66cd2b7d27163b7c91d60bf3835bc98e2972f73a435419
Instruction Fuzzy Hash: B801A7757812446BCB14FB91C9659FFB7A8DB11340F280019B456B7282EA319E1887B1

Function 00DE1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

Part of subcall function 00DE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DE3CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00DE1CC8

Strings

ListBox, xrefs: 00DE1C94
ComboBox, xrefs: 00DE1C69

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 3bbff45de7d9fb92803a5f2bfad3e214cccbe839f2874934ada9f504cb560f92
Instruction ID: aaf444145cca8bedd11adeb3d071a16773e419f8c3e6f0dc96b83f650390c607
Opcode Fuzzy Hash: 3bbff45de7d9fb92803a5f2bfad3e214cccbe839f2874934ada9f504cb560f92
Instruction Fuzzy Hash: E2018BB578125567CB14FB96CA15AFEF7A8DB11740F280015B846B3281EA71DF18C771

Function 00DE1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89CB3: _wcslen.LIBCMT ref: 00D89CBD

Part of subcall function 00DE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DE3CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00DE1DD3

Strings

ListBox, xrefs: 00DE1DA0
ComboBox, xrefs: 00DE1D75

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 8e5dedb019b30ec21728890032ed68471a9584c06de300d65198bdd90d9e8dd9
Instruction ID: 7a8111643f7c206c426fa323c00386e6752bce48bf4997443fcceff033939684
Opcode Fuzzy Hash: 8e5dedb019b30ec21728890032ed68471a9584c06de300d65198bdd90d9e8dd9
Instruction Fuzzy Hash: 2CF0F475B416586BCB04F7A6CC66AFEB378EB01340F180915B862732C2EA7199088370

Function 00E18172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00E53018,00E5305C), ref: 00E181BF
CloseHandle.KERNEL32 ref: 00E181D1

Strings

\0, xrefs: 00E1818A

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0
API String ID: 3712363035-3218720685
Opcode ID: 02b0aa60f83a32d6484083004069ff9e71e66e8f35440c417b6664aa66c111cf
Instruction ID: 36a6b271ab4d9806b8fb1608886e7b81090c670cd2e5b27c57d0c2870717a2a8
Opcode Fuzzy Hash: 02b0aa60f83a32d6484083004069ff9e71e66e8f35440c417b6664aa66c111cf
Instruction Fuzzy Hash: FAF05EB1641300BEE6206B76AC46FB73A5CDB05792F004864FB08F51E2D6758E1882B8

Function 00E0747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E07493
_wcslen.LIBCMT ref: 00E074B9

Strings

3, 3, 16, 1, xrefs: 00E07483

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: c4c42dae288eb00a7c36302a85436a3df94a69e22953deb6a3ade99d714b7ed4
Instruction ID: f9b943822ea3863a252fc3691779f2b3840f14b1fd10af9cd6855999ae6aa391
Opcode Fuzzy Hash: c4c42dae288eb00a7c36302a85436a3df94a69e22953deb6a3ade99d714b7ed4
Instruction Fuzzy Hash: 45E02B02A0436010D2311779ACC197F9A8DCFC6760710282FF9D1E22A6EAD49DE193B0

Function 00DE0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00DE0B23

Strings

Error allocating memory., xrefs: 00DE0B1C
AutoIt, xrefs: 00DE0B17

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 4a47dd387b9596af611fd9d420207fb7ab20670292fc9d4698aace6b9e6c5b69
Instruction ID: c362052935aedf355ccc19c0c0cc0309efcb88e70bf659492df00d2148d9740d
Opcode Fuzzy Hash: 4a47dd387b9596af611fd9d420207fb7ab20670292fc9d4698aace6b9e6c5b69
Instruction Fuzzy Hash: 28E04F322843182BD61437957C03FC9BA85DF46F61F20542AFB98E55C38AE269A046F9

Function 00DA0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00D9F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00DA0D71,?,?,?,00D8100A), ref: 00D9F7CE

IsDebuggerPresent.KERNEL32(?,?,?,00D8100A), ref: 00DA0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00D8100A), ref: 00DA0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00DA0D7F

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: b830a912da1c185f381615a3f2cea8574f3409baffe2860cc4b9e1d70e20f64c
Instruction ID: 1244b7422fb9965eae94d29c9be7e8851d7991ea602c03f287da2c2e5b2dda6f
Opcode Fuzzy Hash: b830a912da1c185f381615a3f2cea8574f3409baffe2860cc4b9e1d70e20f64c
Instruction Fuzzy Hash: F3E06D742007018FD760AFB9D4083827FE0AB01741F04896DE486D6A61DBB4E488CBB1

Function 00D9E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00D9E3D5

Strings

8%, xrefs: 00D9E3CA
0%, xrefs: 00D9E3B5

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%$8%
API String ID: 1385522511-2949748613
Opcode ID: 7bc3ba057f89c0b14ae747660a438d140b5f3cb0feff2dde7002009a894b7f0a
Instruction ID: 5f6805cd0a0e1dddf9ffa0e98230bcbafb740b82a9d217760c99386663406002
Opcode Fuzzy Hash: 7bc3ba057f89c0b14ae747660a438d140b5f3cb0feff2dde7002009a894b7f0a
Instruction Fuzzy Hash: 81E02631400B10CFCF08EF19F855A883351EB5B323F149A6DE602AB1D1FB312885867A

Function 00DF3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00DF302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00DF3044

Strings

aut, xrefs: 00DF3038

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 013fca8798dd07cf01ded30fc4e91cdd08d0eb56d6b1c0e6232ec2cab56eabab
Instruction ID: 29fe882d858795d78023275f6f356ac4c32369126cbe8fc211995d6d31fb3996
Opcode Fuzzy Hash: 013fca8798dd07cf01ded30fc4e91cdd08d0eb56d6b1c0e6232ec2cab56eabab
Instruction Fuzzy Hash: 02D05B71540314ABDA209795AC0DFC73A6CD705750F0001517655F20A1DAF09548CAD0

Function 00DDD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00DDD220

Strings

%.3d, xrefs: 00DDD22B
X64, xrefs: 00DDD2A8

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 9ee0f7b2beb9c636063e6f1198f68d5b3a1094c741edeafe5be803c778171491
Instruction ID: 9dc1165690aa47744c538ce5cc3f97ea0692fa5b15ea9909f43d8ab12a2beea9
Opcode Fuzzy Hash: 9ee0f7b2beb9c636063e6f1198f68d5b3a1094c741edeafe5be803c778171491
Instruction Fuzzy Hash: 32D012B1848108FACF509BD0DC458F9B77DEB18341F608453F886E1140E634C508A775

Function 00E12356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E1236C
PostMessageW.USER32(00000000), ref: 00E12373

Part of subcall function 00DEE97B: Sleep.KERNELBASE ref: 00DEE9F3

Strings

Shell_TrayWnd, xrefs: 00E12365

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 3591061a9c604bbf9bd9278d9aba1e576be6477f841938a2ce0386998d65177b
Instruction ID: e67f6a45f515f3526dad20f121dc624dbdfb4043fb74a117f7b90b449f31cffd
Opcode Fuzzy Hash: 3591061a9c604bbf9bd9278d9aba1e576be6477f841938a2ce0386998d65177b
Instruction Fuzzy Hash: C2D0A9323C03107FE264BB72EC0FFC6A6049B00B00F1089027202FA0E0C8A0A804CA25

Function 00E12322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E1232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00E1233F

Part of subcall function 00DEE97B: Sleep.KERNELBASE ref: 00DEE9F3

Strings

Shell_TrayWnd, xrefs: 00E12325

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 4fb9db372a16c0c03b417f7e58f89f28ebae4ff8a066d4ed664af9156eb964fd
Instruction ID: 4cff3aeb2ced1aacba5c86af8a2f2db41b8aeb994fee83f78c8a922d1417dd90
Opcode Fuzzy Hash: 4fb9db372a16c0c03b417f7e58f89f28ebae4ff8a066d4ed664af9156eb964fd
Instruction Fuzzy Hash: 6DD0A9323C0310BBE264BB72EC0FFC6AA049B00B00F1089027206FA0E0C8A0A804CA20

Function 00DBBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00DBBE93
GetLastError.KERNEL32 ref: 00DBBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DBBEFC

Memory Dump Source

Source File: 00000000.00000002.2971258934.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.2971236223.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E1C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971349547.0000000000E42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971408609.0000000000E4C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2971432276.0000000000E54000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 1eee4e64991e23fa36a86d5791ab6d3b428b6cee8cca7ac39e1df5d22905a865
Instruction ID: 7fd4092670b9b80eb033402c33f83ae966d48c1b45a519080fe295665ddc2207
Opcode Fuzzy Hash: 1eee4e64991e23fa36a86d5791ab6d3b428b6cee8cca7ac39e1df5d22905a865
Instruction Fuzzy Hash: 7141C335605206EFCB218FA5CC44AFA7BA5EF46730F28416AF95A971A1DBB1CD01CB70

Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726238847&P2=404&P3=2&P4=ZJiiOvRBe%2b9%2bJI%2fXcAO1dUUrGMzPd1brAt%2bvxklo0Lhr5dVkZk%2f7r2%2fXerJxncA1hnM6aAJfTxbPG9d3jE5gAQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 4cxfZBV2PfMfdOblFNtQNSSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ESVUozsBaVxxmsv&MD=dBosmPUx HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726238847&P2=404&P3=2&P4=ZJiiOvRBe%2b9%2bJI%2fXcAO1dUUrGMzPd1brAt%2bvxklo0Lhr5dVkZk%2f7r2%2fXerJxncA1hnM6aAJfTxbPG9d3jE5gAQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 4cxfZBV2PfMfdOblFNtQNSSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ESVUozsBaVxxmsv&MD=dBosmPUx HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.110
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.100

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1167df3f-a704-4f39-ad12-43daf9ae9217.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1715d9f4-4bd4-4076-bf38-52cb4639bf76.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\24903562-e2b0-44c2-9508-cc79025b5cfe.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\30f7cce0-e9d6-4f92-ab22-bf2d4fbbbac5.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\36c608e2-e4f5-4fb1-bb18-41c43cdbe931.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\43bafc1b-843c-46d4-b468-33659d85e59f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4aa6e18a-8a96-47b6-9eb5-2cb38e8341f3.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4c211909-58e3-404a-b7e5-0dcd646c5f6d.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\85e98e90-9b30-4003-a11a-37e42979d2ce.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\00cc21de-b828-4190-a1de-d74fd21cc46d.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66DB15E8-10FC.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66DB15E8-1B44.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0bdfdee1-09eb-4c46-8139-cacbe6605292.tmp

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre