Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1505724
MD5:	207bf66a2668d5c2d78a611f168ad978
SHA1:	3dccd922f5e5b784d3c50277002715659743aa16
SHA256:	29018ab3dabe541af4f7ea06336fdd0436095629c9b72bfeaa70ae80155648e0
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6256 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 207BF66A2668D5C2D78A611F168AD978)

msedge.exe (PID: 6520 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3852 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2064,i,3517127856426492125,8360373412142169732,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2800 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7392 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8520 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7252 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8532 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7144 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8608 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8628 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 8972 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 736 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1872 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8248 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4640 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8700 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6072 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8664 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6072 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 8120 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6572 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2068,i,15832991764114500608,6720027621333838498,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9056 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5728 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2024,i,10775744642403109181,5737898232624335056,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7176 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7012 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2096,i,1751193295412844575,18210641973751138716,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.2946709558.00000000013E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2946709558.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.12.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.12.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.12.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: d5974024-c350-4f19-ac8d-29e9b24a95cf.tmp.13.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.12.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: d5974024-c350-4f19-ac8d-29e9b24a95cf.tmp.13.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.12.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: file.exe, 00000000.00000002.2946478155.0000000000BE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: content.js.12.dr, content_new.js.12.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: d5974024-c350-4f19-ac8d-29e9b24a95cf.tmp.13.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49796 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A5EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00A5EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A5ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00A5ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_00A5EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A4AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00A4AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A79576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00A79576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1687769152.0000000000AA2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_fad3138a-5
Source: file.exe, 00000000.00000000.1687769152.0000000000AA2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0f36e5c9-8
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_88ece933-d
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d1812369-c

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A4D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00A4D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A41201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00A41201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A4E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00A4E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A52046	0_2_00A52046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E8060	0_2_009E8060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A48298	0_2_00A48298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1E4FF	0_2_00A1E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1676B	0_2_00A1676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A74873	0_2_00A74873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0CAA0	0_2_00A0CAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009ECAF0	0_2_009ECAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FCC39	0_2_009FCC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A16DD9	0_2_00A16DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E91C0	0_2_009E91C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FB119	0_2_009FB119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A01394	0_2_00A01394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A01706	0_2_00A01706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0781B	0_2_00A0781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A019B0	0_2_00A019B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E7920	0_2_009E7920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F997D	0_2_009F997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A07A4A	0_2_00A07A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A07CA7	0_2_00A07CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A01C77	0_2_00A01C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A19EEE	0_2_00A19EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6BE44	0_2_00A6BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A01F32	0_2_00A01F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A00A30 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 009FF9F2 appears 31 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.evad.winEXE@96/519@22/13

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A537B5 GetLastError,FormatMessageW,

0_2_00A537B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A410BF AdjustTokenPrivileges,CloseHandle,		0_2_00A410BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A416C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00A416C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A551CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00A551CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A6A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00A6A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A5648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00A5648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009E42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_009E42A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\5ba034e9-2c42-4f38-afde-e716453c0734.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.12.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2064,i,3517127856426492125,8360373412142169732,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7252 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7144 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1872 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4640 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6072 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6072 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2068,i,15832991764114500608,6720027621333838498,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2024,i,10775744642403109181,5737898232624335056,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2096,i,1751193295412844575,18210641973751138716,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2064,i,3517127856426492125,8360373412142169732,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7252 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7144 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1872 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4640 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6072 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6072 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2068,i,15832991764114500608,6720027621333838498,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2024,i,10775744642403109181,5737898232624335056,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2096,i,1751193295412844575,18210641973751138716,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009E42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A00A76 push ecx; ret

0_2_00A00A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_009FF98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A71C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00A71C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95209

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6808

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.3 %

Source: C:\Users\user\Desktop\file.exe TID: 6260

Thread sleep time: -68080s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6808 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A4DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A568EE FindFirstFileW,FindClose,	0_2_00A568EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00A5698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A4D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A4D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A59642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A59642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A5979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A59B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00A59B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A55C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00A55C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009E42DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-95465

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A5EAA2 BlockInput,

0_2_00A5EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A12622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00A12622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009E42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A04CE8 mov eax, dword ptr fs:[00000030h]

0_2_00A04CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A40B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00A40B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A12622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A12622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A0083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A009D5 SetUnhandledExceptionFilter,	0_2_00A009D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A00C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00A00C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00A41201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A22BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00A22BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009FF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_009FF98E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A622DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00A622DA

Source: C:\Users\user\Desktop\file.exe

0_2_00A40B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A41663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00A41663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A00698 cpuid

0_2_00A00698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A58195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00A58195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A3D27A GetUserNameW,

0_2_00A3D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A1BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00A1BB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009E42DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A61204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00A61204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A61806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00A61806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	26%	ReversingLabs
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://chrome.cloudflare-dns.com	0%	Avira URL Cloud	safe
https://drive-daily-1.corp.google.com/	0%	Avira URL Cloud	safe
https://drive-daily-2.corp.google.com/	0%	Avira URL Cloud	safe
https://drive-daily-4.corp.google.com/	0%	Avira URL Cloud	safe
https://drive-daily-5.corp.google.com/	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://drive-autopush.corp.google.com/	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://drive-staging.corp.google.com/	0%	Avira URL Cloud	safe
https://chrome.cloudflare-dns.com/dns-query	0%	Avira URL Cloud	safe
https://drive-preprod.corp.google.com/	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://drive-daily-6.corp.google.com/	0%	Avira URL Cloud	safe
https://drive-daily-0.corp.google.com/	0%	Avira URL Cloud	safe
https://chromewebstore.google.com/	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://drive-daily-3.corp.google.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	unknown
s-part-0036.t-0009.t-msedge.net	13.107.246.64	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.185.225	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	Avira URL Cloud: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.12.dr	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.12.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.12.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.5.dr	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome	content.js.12.dr, content_new.js.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://clients2.googleusercontent.com	d5974024-c350-4f19-ac8d-29e9b24a95cf.tmp.13.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.12.dr	false	Avira URL Cloud: safe	unknown
https://myaccount.google.com/signinoptions/passwordC:	file.exe, 00000000.00000002.2946478155.0000000000BE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.46	unknown	United States	15169	GOOGLEUS	false
23.200.0.42	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.64	s-part-0036.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.165.132	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.17
192.168.2.16
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1505724
Start date and time:	2024-09-06 18:03:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@96/519@22/13
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 43 Number of non-executed functions: 309
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 142.251.5.84, 204.79.197.239, 13.107.21.239, 13.107.6.158, 2.19.126.152, 2.19.126.145, 172.217.18.3, 216.58.206.35, 2.22.50.227, 2.22.50.217, 20.223.35.26, 88.221.110.91, 192.229.221.95, 142.250.184.206, 142.250.186.42, 172.217.18.10, 142.250.184.202, 142.250.186.138, 142.250.74.202, 142.250.186.74, 216.58.206.42, 142.250.185.202, 142.250.185.74, 142.250.185.234, 142.250.185.170, 172.217.18.106, 142.250.181.234, 216.58.206.74, 172.217.16.202, 216.58.212.138, 74.125.71.84, 142.251.40.163, 142.251.40.195, 142.250.65.163, 142.251.40.227, 142.251.41.3
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-0007.config.skype.com, edgeassetservice.azureedge.net, azur
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:04:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
17:04:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
17:04:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
17:04:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.200.0.42	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
13.107.246.64	RANGLANDLAW.xlsx	Get hash	malicious	Unknown	Browse
	bad_site.html	Get hash	malicious	HTMLPhisher	Browse
	https://forms.office.com/Pages/ShareFormPage.aspx?id=ftLiCkvgmUWRfqw5YPs3_fpDqIXyltBNn_DKM6uFDvVUNlhVQ1g1MVZJWEZEOE5MVVBERkI4MVRKVC4u&sharetoken=4ily2rwaUoxDpLkfEsVo	Get hash	malicious	Unknown	Browse
	https://www.cognitoforms.com/Gbauto1/GBAuto	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://sites.google.com/view/xxwws/home	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0036.t-0009.t-msedge.net	RANGLANDLAW.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.64
	bad_site.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.64
	https://forms.office.com/Pages/ShareFormPage.aspx?id=ftLiCkvgmUWRfqw5YPs3_fpDqIXyltBNn_DKM6uFDvVUNlhVQ1g1MVZJWEZEOE5MVVBERkI4MVRKVC4u&sharetoken=4ily2rwaUoxDpLkfEsVo	Get hash	malicious	Unknown	Browse	13.107.246.64
	https://www.cognitoforms.com/Gbauto1/GBAuto	Get hash	malicious	HTMLPhisher	Browse	13.107.246.64
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.64
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.64
	https://sites.google.com/view/xxwws/home	Get hash	malicious	Unknown	Browse	13.107.246.64
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	13.107.246.64
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.64
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.64
s-part-0032.t-0009.t-msedge.net	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://www.google.com/url?q=https://google.com/url?hl%3Den%26q%3Dhttps://google.com/url?q%3D4xNZLlTBeMrz3JgT2S2x%26rct%3Duxx6lWWQSQg3lz6tBGEQ%26sa%3Dt%26esrc%3DLnMkARnwEn0HQZmQHxxK%26source%3D%26cd%3DCFK8mnhX1pEg7TmGNG8P%26cad%3DnNq1ozyXGrC1kDZTqknt%26ved%3DYxsBoVntlMlmOm9lZwVR%26uact%3D%26url%3Damp%252Fsushanta.com%252F21%252F&source=gmail&ust=1725491985982000&usg=AOvVaw2OjIR7ELr3F4rLhFIHiJIH#OvyuiE-SUREMAYYcmVpbmEuYXZpbGFAc3RndXNhLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	All-in-one Calculation Tool.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://emails.microsoft.com/dc/e_4JGRIDqcoiTU1HR-giCWWkyCmeORqUCO4pEjpDTddrBVlbCteZJj8QfhFvhzGnrSwkFwZUI8U0ElApY3ruN2moaZlprSDGWrxtrbI1MBxlzIbpGFmlWRXVz-DfjyzMo6DjGJvk2NdT1NgnbRCGzTYRw7PzgS1STErkGqov-2A=/MTU3LUdRRS0zODIAAAGVXrvPPFFO4qk2k5S0WBN6iOmgYzwr15ol9HTLY_vuNwgIljWNKTe4HuyrKAtA0lJBatyTgWI=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://emails.microsoft.com/dc/zSgS2A6q0riGfHtfc6vB4o2EDiQ6lN3O6qiMomONyUJ0HsQ2sZIsMh689GSSYbTLO3mCkWaodie4MAOslvNCWW_9a3plE0P-Ez0LQY78TZmDPHuwNSWhLFzTYMtoZfimsqDGDjfg-w-v-HUlOmaZvGFLFwxVF_4UkVJu8KOKwPs=/MTU3LUdRRS0zODIAAAGVXXQTXko_YJBSIbQm_RlsGLlFgr2A-kJcbF9EmGwaO1zI2Do4ydFFpnBfqgMZYQyQQ3e8Go8=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	709827261526152615.exe	Get hash	malicious	FormBook	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	709827261526152615.exe	Get hash	malicious	FormBook	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.9
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.9
	file.exe	Get hash	malicious	Unknown	Browse	23.219.82.73
	NEOM_SUPPLIER_EOI&QUESTIONNAIR_FORM_SHEET.PDF.EXE	Get hash	malicious	AgentTesla, RedLine	Browse	172.234.222.138
	file.exe	Get hash	malicious	Unknown	Browse	23.44.201.31
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse	23.44.201.4
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.44.201.36
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.44.201.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	Factura de proforma.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.107.137.11
	Payment Details.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.107.137.11
	ESW31074TS510.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	PI and payment confirmed Pdf.exe	Get hash	malicious	DBatLoader	Browse	13.107.139.11
	Assessment from SARS.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	https://www.dropbox.com/scl/fo/dypnewy032frqiop6d7gh/AGQRgoJcNqKPbhsYQheP8nM?rlkey=t6ozmhhbporfamqnz8ddx2in0&st=r8w1wv0v&dl=0	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	https://www.google.com/url?q=https://google.com/url?hl%3Den%26q%3Dhttps://google.com/url?q%3D4xNZLlTBeMrz3JgT2S2x%26rct%3Duxx6lWWQSQg3lz6tBGEQ%26sa%3Dt%26esrc%3DLnMkARnwEn0HQZmQHxxK%26source%3D%26cd%3DCFK8mnhX1pEg7TmGNG8P%26cad%3DnNq1ozyXGrC1kDZTqknt%26ved%3DYxsBoVntlMlmOm9lZwVR%26uact%3D%26url%3Damp%252Fsushanta.com%252F21%252F&source=gmail&ust=1725491985982000&usg=AOvVaw2OjIR7ELr3F4rLhFIHiJIH#OvyuiE-SUREMAYYcmVpbmEuYXZpbGFAc3RndXNhLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	Factura de proforma.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.107.137.11
	Payment Details.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.107.137.11
	ESW31074TS510.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	PI and payment confirmed Pdf.exe	Get hash	malicious	DBatLoader	Browse	13.107.139.11
	Assessment from SARS.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	https://www.dropbox.com/scl/fo/dypnewy032frqiop6d7gh/AGQRgoJcNqKPbhsYQheP8nM?rlkey=t6ozmhhbporfamqnz8ddx2in0&st=r8w1wv0v&dl=0	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	https://www.google.com/url?q=https://google.com/url?hl%3Den%26q%3Dhttps://google.com/url?q%3D4xNZLlTBeMrz3JgT2S2x%26rct%3Duxx6lWWQSQg3lz6tBGEQ%26sa%3Dt%26esrc%3DLnMkARnwEn0HQZmQHxxK%26source%3D%26cd%3DCFK8mnhX1pEg7TmGNG8P%26cad%3DnNq1ozyXGrC1kDZTqknt%26ved%3DYxsBoVntlMlmOm9lZwVR%26uact%3D%26url%3Damp%252Fsushanta.com%252F21%252F&source=gmail&ust=1725491985982000&usg=AOvVaw2OjIR7ELr3F4rLhFIHiJIH#OvyuiE-SUREMAYYcmVpbmEuYXZpbGFAc3RndXNhLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
EDGECASTUS	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	https://www.google.com/url?q=https://google.com/url?hl%3Den%26q%3Dhttps://google.com/url?q%3D4xNZLlTBeMrz3JgT2S2x%26rct%3Duxx6lWWQSQg3lz6tBGEQ%26sa%3Dt%26esrc%3DLnMkARnwEn0HQZmQHxxK%26source%3D%26cd%3DCFK8mnhX1pEg7TmGNG8P%26cad%3DnNq1ozyXGrC1kDZTqknt%26ved%3DYxsBoVntlMlmOm9lZwVR%26uact%3D%26url%3Damp%252Fsushanta.com%252F21%252F&source=gmail&ust=1725491985982000&usg=AOvVaw2OjIR7ELr3F4rLhFIHiJIH#OvyuiE-SUREMAYYcmVpbmEuYXZpbGFAc3RndXNhLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	Remittance Advice.eml	Get hash	malicious	ReCaptcha Phish	Browse	152.199.23.180
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	709827261526152615.exe	Get hash	malicious	FormBook	Browse	152.195.19.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://govedge.filegear-de.me	Get hash	malicious	Unknown	Browse	23.32.185.164 13.85.23.86
	https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6Imd1eS5kZXdldmVyZUBnbWFpbC5jb20iLCJyZXF1ZXN0SWQiOiIyNzczOGRmMy03M2IwLTQxYzItNWU5Ny0zNDExYmYzYjY1MTMiLCJsaW5rIjoiaHR0cHM6Ly93d3cuYWRvYmUuY29tL2dvL2FjY291bnQiLCJsYWJlbCI6IjE0IiwibG9jYWxlIjoiZW5fVVMifQ.-e9y5T8AddJrXF7HspJSVAUvaQM7bAICWTxGXf-0IUXxljW3dUDJIi6QE5ahvpJIkyaVRt4Et8wmxKZjM01I8w	Get hash	malicious	Unknown	Browse	23.32.185.164 13.85.23.86
	https://www.bkmmedya.com/m/?c3Y9bzM2NV8xX29uZSZyYW5kPVNsZFhhalE9JnVpZD1VU0VSMDMwOTIwMjRVMzgwOTAzMjA=N0123N	Get hash	malicious	Unknown	Browse	23.32.185.164 13.85.23.86
	http://packedbrick.com	Get hash	malicious	Unknown	Browse	23.32.185.164 13.85.23.86
	http://hochstedlerenergy.com	Get hash	malicious	Unknown	Browse	23.32.185.164 13.85.23.86
	https://quickfixman.in/	Get hash	malicious	Unknown	Browse	23.32.185.164 13.85.23.86
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	Unknown	Browse	23.32.185.164 13.85.23.86
	file.exe	Get hash	malicious	Unknown	Browse	23.32.185.164 13.85.23.86
	Play_VM-NowMarge.mcintireAudiowav012.html	Get hash	malicious	HTMLPhisher	Browse	23.32.185.164 13.85.23.86
	https://mpticketing.logolsolutions.it/	Get hash	malicious	Unknown	Browse	23.32.185.164 13.85.23.86

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20982
Entropy (8bit):	6.064678682709007
Encrypted:	false
SSDEEP:	384:ttMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS7FV14K8T3hQsYIXwzAvPWGc:HMGQ7FCYXGIgtDAWtJ4nnR8T3rwzlJ
MD5:	7B5254C2430C15487B9FC6102CF87116
SHA1:	625B75B898244F3BF42CF5DD7BB8D1EDEC0153AC
SHA-256:	7FC8C920080D59402FB56E1055D1F0D2CE70168410E2CAD964301B97E9FD4517
SHA-512:	1253DDC0B8520A3429DA8E8F0D7A6DC3697346240BD2C1FA5770966422F7C5297654094046822C4B9E5096C2672059E9B1A06699BFA47EB851C142BB2094CF11
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370112241225564","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3826f2d0-ffd9-4c74-afb3-7d833b722f7f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20983
Entropy (8bit):	6.064690686005881
Encrypted:	false
SSDEEP:	384:ttMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS7FV1vK8T3hQsYIXwzAvPWGc:HMGQ7FCYXGIgtDAWtJ4nnw8T3rwzlJ
MD5:	317C4171439BB00FB4FA9B39A473B6F0
SHA1:	21E25F9F9D2507865F3E3020780F1C28578EE108
SHA-256:	22E41B9355A854246E02E40E8503BDE446D6F014FF9C25E186E3DACEEA4B1F93
SHA-512:	724F195265CEDA110D03A1C420E6D8D53498219DEA07FD7F0BD803A3ACC0128BA50A52B811B83DBAFD622E87FBCBFF18384B9E7FD08D1D0DE528FC75462A3FC1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370112241225564","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3e5f9d6d-66a2-4264-a282-fa16cef2b738.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.579598615835296
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afS3l1NMkLZkHB+OdrxdKzvBY9H+tRxb6WbPaJkXHc7xwlRG1:Xq8NkC1fS3l1NMkLgBXzKzve9ebxbAJp
MD5:	DFC938A2930BF11DF065D026D7185632
SHA1:	A72B53146CB1BF3DF1D85E6AB69DA12137849002
SHA-256:	475C501EC7ED2C8B0FACBFE7BDE8EC61B77ED90863830112F8596F8E3995FD72
SHA-512:	17856546F54EB7C6D1C60740337DA1671828590E1AAB8F2E75118E4BBFE1D1E708E22AB4CA0B10B5F0183AD7A9A8DD8D8CD871564D5945E0EB8214E126860981
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"policy":{"last_statistics_update":"13370112239480695"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4484b8d5-4ea8-4b62-98a0-48304dfc0f70.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3351
Entropy (8bit):	5.606510314901631
Encrypted:	false
SSDEEP:	96:0q8NkC1fS3l1NMkLeSBXzKzve9FbxqoJk3clSDS4S4SDS9GI4a:/8NbQ3l1/NjHbgIk3hD
MD5:	E18A86A6410F3197CE354D479505E68B
SHA1:	493592ECC50889B1DF08A8034178F4FA031228BC
SHA-256:	5D280B7F912D03F97F28D23BAAD7B2F01036EA80947CFB160426134B37D8A5D2
SHA-512:	CAED767F190927E4E68C5850C10871020FE0D161B3B849CDEC210123B37390128D453764842F0B99B7B1910DD13EC22264A71CF7F94A1C75D2ED37D3B1D6FF40
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\474df136-85e3-432b-98ae-ea62a778e083.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24303
Entropy (8bit):	6.055171359442257
Encrypted:	false
SSDEEP:	384:ttMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NG7FV1vKj5qdpVEmzw9sX4bsYIXwzAvPE:HMGQ7FCYXGIgtDAWtJ4nFwjfmzw9sX4v
MD5:	AD7D93B72B406A408C432DAD070E8CEC
SHA1:	C1CCD3AF07F02D2CFAD81BE602E6527B15B653ED
SHA-256:	D39D90A328F05E8BFF0A4532D5D2129E204D5656AB0C5921F3125A516727195F
SHA-512:	6C0605ED21A1769E22ACF041F3F4BD5842D384DA0AC5AF6C0FBE80719D0F522A67FC752E7A1B794513F9FDA2B05631F5318F5DE7502DA03278072D5608A3173F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370112241225564","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4dd67b63-05c5-47b8-b468-8425023922da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20983
Entropy (8bit):	6.064700749774949
Encrypted:	false
SSDEEP:	384:ttMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS7FV1bK8T3hQsYIXwzAvPWGc:HMGQ7FCYXGIgtDAWtJ4nnk8T3rwzlJ
MD5:	522BE9924130DA0A4586C0157065695F
SHA1:	C37690520C4A0179D8C0F8A0B41C27C79F91BF6E
SHA-256:	3D4EB80F564346C85DEAE0D134F24CF6D362F2B588A0186180D8A6D8C03EA850
SHA-512:	72F4473AB68CBE93E73D96F94C6EA58F4ECBDD599F5E073E3D470747A35CFD133151A8F70F733CC36AB69F9121BC52D7E0D253A592044ABAED8096166DDE089E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370112241225564","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4fd11db7-7b54-4a3f-9e94-3b3fd09c67f9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518336973631551
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtI3Y8BDmoTbckSO9yike1JdXBuBuwBYak3aNhIx3XWQQRCYfYg:YuBqDPafS3l1NMkrZgBzBY9sIx3HB0
MD5:	892FF4620E48FEA4ABCE9231CE1B371E
SHA1:	FEC2D4C70F0E622480CD5036ED54CDDD9E7CBEDB
SHA-256:	D0B17635B3BA5D8A98FE729825F562C06426DC6F27AC3B03DAF6358C2542F824
SHA-512:	71CA3C17C3E887DC65368BD42B301C6106E725E1AAE35A6695116CAA6C38D3593FEC713CE00E006AE7CA61D6B3496A8D82680FB687B00CBFB30E11322342AFA3
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370112239440397","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725638639"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5fcb34aa-f7de-4243-b02a-ab2362ce19fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71029
Entropy (8bit):	6.073622453106997
Encrypted:	false
SSDEEP:	1536:HMGQ5XMBGrScMoWskxgZkz4Wfr5mg4ffMmzVX4fD:HMrJM8rScMo+zPVmCmzVX4r
MD5:	89076AC7302B27C7F664466CE0DD33B2
SHA1:	24C09C3DB4F9E85FC4506A0B4C0E3AB15F6911B8
SHA-256:	892B5CE8131899C55E93D858069908086C596571F20DAC3ECAED3CB0E4AF1163
SHA-512:	8FFDC1F03A757C8250F4C5DE011EA5F541818CB945AA9F3E15049678529E3796CC2A51B578FC490DB43B7E008F2538A9ADB3252C1D64406ADFD84BA670C7B70D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370112241225564","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8ca877fd-0e19-4efd-992f-57ca9290e34c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4251
Entropy (8bit):	5.4939131093358125
Encrypted:	false
SSDEEP:	96:0q8NkGS1fS3l1NMkL58rh/cI9URoDotoLWBXzKzve9FbxqoJk3clSDS4S4SDS9Gi:/8NBSQ3l1/8eoDUdjHbgIk3hD
MD5:	FEFEDE44853F145BB05EFDC828120C28
SHA1:	137598A9ECB51E3192C7C8B3EFE7E0E1F9092851
SHA-256:	B0AC5C082E2989FF37F0C58923DC60DE548D139E21C2B632C1F9F75B7DF57CB6
SHA-512:	FDF5D5D9E366562B4889A30A32AE535C9AD853EABC61ABFEDC1C06AED17E63F4A728216CF92506097017FA35D0601542ECA898EA70C4D492E7D000F70AD493CD
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQd

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8daebccf-e1c9-47df-b602-84fc2d8f9b23.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71068
Entropy (8bit):	6.0736945498999635
Encrypted:	false
SSDEEP:	1536:HMGQ5XMBG2ScMoWskxgZkz4Wfr5mg4ffMmzVX4fD:HMrJM82ScMo+zPVmCmzVX4r
MD5:	AA1CF6AC21E80C97E1AE4A6362AA8743
SHA1:	A6FC5D520349E8C1D3D0B75B8B1F5EC3EB1E0C25
SHA-256:	9D344A0B9A131D5D9611203462BE0C3AE9DC0820D788CC4C2DE078B2C5D8B25C
SHA-512:	A34FFF9D7F560F7BAF19D7731A080BCC19BB6A5054EF44B06C41215F819C41F033022B1413624E0AE1B542F4214C353082A48799FB25BC54A847436463EF21DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370112241225564","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\68cce5a7-3928-4137-be06-ce9796ebfc31.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66DB27EF-1978.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04049775662604268
Encrypted:	false
SSDEEP:	192:S8i4UjLYiVWK+ggCdlkmJtD+FX9XBokgV8vYhafvNEfb8GRQMtrHn8y08Tcm2RGY:xUjjlwmqAnhIudRrH08T2RGOD
MD5:	C1CD28E2A2988FBEDAEAE86AF690A9D9
SHA1:	96493197EA239D68FF972CA9A8F796E8FAE91716
SHA-256:	8A34C711F72F028A8374DC09F4C3871246BA63F6E97F18612BC0B7DF985D2FAD
SHA-512:	270EF2E6DEB25F2F2563AF6B6EBDFC8C3B5A1E2BAACAED1EBA28F5A5531B463F9BD51A81A920668DC437BE36795721D13B3E938ED2B7F87ECD3B44FA9DEF4614
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".euvbab20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@................................9..$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z.....n...L@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66DB27EF-AF0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45769235524073537
Encrypted:	false
SSDEEP:	3072:gZ+A2CAY1q71FM+IwCMX/aW8CDTpl/KlMvqpf0aWThfK6rbg1HF2QPpnZfQVVCxL:fvfXnK6faHf+RJ/x5jaHkEUDQ
MD5:	96FD7F247250DDFC0E532D8337C9240A
SHA1:	EC66B96424E917A7412BAB47EDD192CAF1924449
SHA-256:	84DFF5230167059016599C6DE5ACE7BDE0AF6A1356473E3AC4938679B25A39E1
SHA-512:	38EDFA8C89E949E31FA78B000A327CD78AD4747D71514C15D2F985B3968AE24F9501A0734A514D598D04D69CE197E6153E20BE566F4162D0A8782D56C9B4F81B
Malicious:	false
Preview:	...@..@...@.....C.].....@................]..x\..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".euvbab20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.162156634291502
Encrypted:	false
SSDEEP:	3:FiWWltlUFT3ViHSRqOFhJXI2EyBl+BVP/Sh/JzvJR45hvRpdvUDWX20Xl:o1UhliyRqsx+BVsJDf6hvRzvUKT1
MD5:	1A488AB2E2A4A81A2E0BCABC28556DEB
SHA1:	4763D4262836AE6E3489735703ABFF8379AA5C23
SHA-256:	163DCDFC9FD8B857C0C73C19AEA5F88E35CF64AB9CA11AF2DCCAE2F2FFED8D13
SHA-512:	D47D327E97001855BCD13CEC88AF60ACAFA27110A9394C81135CCB0EC6CE6B8FC4C778E8E17793A32113F1A6EE18690F969C4D6B6C2DA864AFC67CF26CA09F72
Malicious:	false
Preview:	sdPC.......................v?..C....0\.."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................574e82f5-d209-4316-8a80-aac5df326f12............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\006cb12b-d9a9-48fe-97b5-6824094ca3f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9690220173707145
Encrypted:	false
SSDEEP:	96:st0qf+Ois1ub9E0fN8zws85eh6Cb7/x+6MhmuecmAeagu+2Mg/EJ:st0jsKfNkws88bV+FiA5+PgMJ
MD5:	41317AEC604C140829ED851E7ACF6C26
SHA1:	8DA6A99D70779AF41222995A76D5368BEF7941AF
SHA-256:	6D515893F325C61F8012D6FD4D61978D5133C7CCEE8D736ADB6028691A0546A6
SHA-512:	625DF20560C77DABA1A789BA2ED10A2F10A2385C685A3E3E89865B3FE927BDB2B1A4331CF11C433A4866BFEF78045BEE1035A9F4FB7A3C4F891993F4474CD66F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370112240904179","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370112241064578"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\34731036-0b22-4cc7-8a90-e643eaaa421a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3a5c4a81-15fe-4aa5-b312-bb2dae21c9bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565287595487399
Encrypted:	false
SSDEEP:	768:WE4ryEoTWP4efAj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVji3D1rwdpGtuu:TWyEoTWP4efAju1jaKOD+qtN
MD5:	D5772F2A0A6322F26ED33704ADD731F4
SHA1:	CB0A8D6D8110D4E3A7AF17E2C30AF2031AE6A8E3
SHA-256:	31226E4822D247485D76108A8A6474C36216A125277AA0F3AB6599A4E7405EEA
SHA-512:	F031A78A6168185402386F1260260C7F5D5FEADBC99996C984BB1771F3727AC34349CB72695633A7389F0B0DBB8B5E1422777E4D94BDB92140F4BDF734EBE843
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370112240128858","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370112240128858","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\4922dd4d-9aae-45a4-9657-160c85bb27b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\5fa82a33-36b0-4d85-9f98-55290e7eca72.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.565205328803066
Encrypted:	false
SSDEEP:	768:WE4ryEoTWP4efPj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVji3D1rw6pGtuC:TWyEoTWP4efPju1jaKOD+HtB
MD5:	30842E13F4979DEC42C88D1C9887BA36
SHA1:	5A1D8B71BAA3E37B8110F17B25E11C3C4C0F1D7F
SHA-256:	C1C22A2B006F31DA54FF7894C7357286E0F6E74387343322EC822A639494A435
SHA-512:	22A0B41388469876287D501A79B0D033FAD762D1750E9A04EF6F6F4F147CBABA41F7FA6C2358C13090B6FA6BC5CF4D0BB4C41DF7547F4629ED649F28BE992B1F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370112240128858","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370112240128858","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.32079543278911
Encrypted:	false
SSDEEP:	192:7AOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:EOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	1B49795456CBB95CE54BC1F1DB1164B3
SHA1:	ED4C14FE189CDE0DB0E11F0191B54576FC565887
SHA-256:	56FB5860E135E9D1944091B864BFB5FF32DBE7235B69093FF051977A2E311B08
SHA-512:	64AF89740A1CDA40D5202508B528B3E640DA135B61343B2E2F870677488D9AA4DC571F2E02C199D5DDF568E9B47AFB8BAB642E08C4F619B3A34AC9373163FC20
Malicious:	false
Preview:	...m.................DB_VERSION.1.f..................QUERY_TIMESTAMP:arbitration_priority_list4...13370112245360322.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.1193602195750305
Encrypted:	false
SSDEEP:	6:PkoRoGR1wkn23oH+TcwtOEh1ZB2KLllkWDM+q2Pwkn23oH+TcwtOEh1tIFUv:P/SG0fYebOEh1ZFLnVM+vYfYebOEh16g
MD5:	DF44F6D77AFDBA49CC33361DE1653142
SHA1:	113463A1B333FED59A932E066883B3FD2B62B650
SHA-256:	5A1D0063F99E46C3884744CA3089FCC047FF31D350EC6F765279FD452B4A0751
SHA-512:	6F24344A9E4CF5D7ED779618BB1B28D6DFEFCAA6FC614F00F79A0098DCE191BCFA0F9C5DA8B21D5C557E03AFDE6D932EF48B7673B5731DCFF863D3571C611E4A
Malicious:	false
Preview:	2024/09/06-12:04:04.546 216c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/09/06-12:04:04.635 216c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.044308907290965
Encrypted:	false
SSDEEP:	6:/Fii2CQUr0xlikM/lpVgjyCwHfsTB3MtXv2v9SGkllh+vSR/lCI:d6y0xtE7gjyH/sThEXua/h7CI
MD5:	1DD7D09F1A82DF1B9FB1DC5505018BD9
SHA1:	08DCD875C5029F904F993B611C6D001784A766CB
SHA-256:	D75BB99AE06F3DBB02161971F69037F44023205A91D541E403B0F12996D100DB
SHA-512:	8968AEB2A2802BB7037C40EF89D57EE4CDB967163D8F4C59EDB95A093CA96146BD22647B6BEE9BB5F95CADE7F823C73DE9FD961D8E7470844A308D8C6DD6AA75
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09579688867065478
Encrypted:	false
SSDEEP:	48:RV4XesFhV4A3es3NUeGgpUgAMdY1BT3lWp4:RV4X37V4A333NLGI7A8Yf3L
MD5:	66A57C941B3482D437C67E13FEE26057
SHA1:	6CF4A9D7FA5F93002435B747E5D0CBA6C9465D75
SHA-256:	655119032A194FB1436A582BD06D51D018E2C9F86A879E7C727AFC0A4716B593
SHA-512:	77ED3674BEAC499C14C9A77078A6E7B949D0DDB2F3D2B5D083C5E8A5EFDC7476A90E25B055F9B12A2C656C299070B5F0EC8D7B4924EE508469B866FBCC25CFA1
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.2831821097650895
Encrypted:	false
SSDEEP:	384:n2MQJtnG2MQJtn3WJt3ZWJt3eb5f3s48Jtp:n3QJtG3QJt3WJtJWJtI5E48Jt
MD5:	460526E4726745EE4DDC9B96D0E0C004
SHA1:	BD645BCDFF3D29B4AA7C298B3D5D08C16A67083E
SHA-256:	EB8AB67AAB5178275E0557850122EB5D0621917C45D6A35C867148908914D449
SHA-512:	EDF980D31125050BE0CCF79386C58C5B8FB70339B69422031512E3BD2AFB8B4842C475C1E8CCABEA40A35F6AD96CE8A18AF1E4F3D4D1155DE77752DE6134B739
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:LsulgZfll:LslZ
MD5:	666C75E6633DA0B33FED0EFD6B506921
SHA1:	D62F45A3BFD8BBF46CE4D4149A6AE1A4D99734C3
SHA-256:	5D017B8F54B2CE1C7B328BEB458D60DF957E573CC2C6C5F599ED54A8DCB1B1A9
SHA-512:	36954FD7E51221700347B72066DB89AD651F140A09B66594152BB2E9DBE1E87647FB080DE4FD9906DDB3B4B47864318875CC1E5C2F53E31810D44919814C48F4
Malicious:	false
Preview:	......................................../6..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:KhR0Ev/WzqKl:KfvemKl
MD5:	3EB39DB56C446D05995AABEC334CE503
SHA1:	B81714DCBAB9720124502D1C00E8BBC791B290E9
SHA-256:	BCA8B22E31EEA1B5502A7B55F717DB46887EA63BD9AD548B5684557E300E7127
SHA-512:	C4E41B4C3F5E54E02B48C8BD681435FFBC3C12A707351306491A8F42DD268EA4DD58AA1DD33C46C42939D26139C3314D8649667EC178969FB49389BE206C8E48
Malicious:	false
Preview:	(...W..Voy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:KhR0Ev/WzqKl:KfvemKl
MD5:	3EB39DB56C446D05995AABEC334CE503
SHA1:	B81714DCBAB9720124502D1C00E8BBC791B290E9
SHA-256:	BCA8B22E31EEA1B5502A7B55F717DB46887EA63BD9AD548B5684557E300E7127
SHA-512:	C4E41B4C3F5E54E02B48C8BD681435FFBC3C12A707351306491A8F42DD268EA4DD58AA1DD33C46C42939D26139C3314D8649667EC178969FB49389BE206C8E48
Malicious:	false
Preview:	(...W..Voy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:cxRTEcrRzuw:cxRgaEw
MD5:	3882A09DA236A38B19D97AC6F372A052
SHA1:	85453887ECC0C1B75E7DD34BBCCC246848CE8C3E
SHA-256:	8356A7A1A7E550ED620EC362EB5A5EC9FC0AF8F27C16ECEEAA85617B428603C9
SHA-512:	93FD629C975BC1E4C27552DD9C8D6D0F0FCCE204B63B6B51150B756A398CBB95B3035C7DC5E50B029EB005C5E0CA5187B0243132D854DFB80B2E685BFE4E79E6
Malicious:	false
Preview:	(...A...oy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:cxRTEcrRzuw:cxRgaEw
MD5:	3882A09DA236A38B19D97AC6F372A052
SHA1:	85453887ECC0C1B75E7DD34BBCCC246848CE8C3E
SHA-256:	8356A7A1A7E550ED620EC362EB5A5EC9FC0AF8F27C16ECEEAA85617B428603C9
SHA-512:	93FD629C975BC1E4C27552DD9C8D6D0F0FCCE204B63B6B51150B756A398CBB95B3035C7DC5E50B029EB005C5E0CA5187B0243132D854DFB80B2E685BFE4E79E6
Malicious:	false
Preview:	(...A...oy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlWuQ/lll:Ls3WuQ1
MD5:	DB6AD597D3D38A0BB2FB2CA47980CBD8
SHA1:	F9337C3A09133701EAD60DDD86759764684C793A
SHA-256:	37B9EEFB1198863C2C97FEEF8FC23C237D3B517D59A3FAD868804279710897E3
SHA-512:	2DAF0D063D29046F01403CB8D6C800FAAD301F7300F6B1D27312541069E9192D9BF15A5F74D991A3D22F3547006B3D3A90AD5EC8054792471B5E61A1F54DDCB8
Malicious:	false
Preview:	........................................:...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354116722827039
Encrypted:	false
SSDEEP:	6144:xA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:xFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	A32960787F75B34DC863C4F237651DE8
SHA1:	FA5F2C4E5C7AA7697561059F2A902C28C2BD4EA1
SHA-256:	058F1535961747CAB31C162CACB510274D1A4B99C3BA489AB3BEA71D26484C54
SHA-512:	80999AA44EA9136C5A7BD768C8E50C14BD13021D331041B11BBC123AB24AAD86C0FD5AB2B4C73285E56B471BEDAE3DB0E195BBDDC2074522D086AC0264DCB666
Malicious:	false
Preview:	...m.................DB_VERSION.1.P.Oq...............&QUERY_TIMESTAMP:domains_config_gz2...13370112244687297..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.221867039523251
Encrypted:	false
SSDEEP:	6:Pko++q1wkn23oH+Tcwtj2WwnvB2KLllkoTNtN+q2Pwkn23oH+Tcwtj2WwnvIFUv:P/++1fYebjxwnvFLn/TfIvYfYebjxwnp
MD5:	F834B4C720A49421584BD28EF8795812
SHA1:	C7E96FF6DAFCFB2C59ACB1D27B3DA6E45BCE368F
SHA-256:	20FC3B8E2ABF05BB7C512471719A28DC6BD08CECE1C0A4A72D8C01DF85E1E7E6
SHA-512:	3507FD1275789D702787B8F3EB0A9494D1B60ECB7F3446E0FF0E94BF02AB79FD3F8AC3F19DBF22550C3375E775A22CC88E93B792FAD96228B0D2B2C7FAB768D5
Malicious:	false
Preview:	2024/09/06-12:04:04.531 2188 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/09/06-12:04:04.563 2188 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324621002591138
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RR:C1gAg1zfvJ
MD5:	19277E31E6EE411D22DE3431C8AAF076
SHA1:	4FEC8C4ECF6DB78E253FC1A7897AC6288EEBDAE8
SHA-256:	FA18C485FE08F14121CE5EE9A372180BDC02FC2C1E6F27D0F2FA5681D5F6B9CB
SHA-512:	C902E32B83927A4D4E77378161277484CB33EAFC718AA25F0EDD89EA9C8BE14E68A2A7577A7E0EA6D7455029B0D394FC34B6321CC5D9247221E2801CE119238C
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.145105947407898
Encrypted:	false
SSDEEP:	6:PkEcEVc81wkn23oH+TcwttaVdg2KLllkGyq2Pwkn23oH+TcwttaPrqIFUv:Pe8cbfYebDLnqvYfYeb83FUv
MD5:	8283B25E75049E9D88F25DD602C06B9D
SHA1:	F1475208CAD2A2AB0FC36254EB80F28542CAB21B
SHA-256:	C51F16532DB809DEF77EA974FAB769AF3527843F414D4B9CE6F9F202808F07F9
SHA-512:	F91A36BB83222DEE89EE670F74B38AA2F1E2C817723FFA21C7A54E4EFDBFF066A11F821C053A4D55F0FCF50E1FECF4BA548BD23B9E602B301CEE0E33EFD0C1B7
Malicious:	false
Preview:	2024/09/06-12:04:00.431 1ca0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/09/06-12:04:00.688 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.116981902596254
Encrypted:	false
SSDEEP:	6:PkkWvm81wkn23oH+Tcwtt6FB2KLllkNoyq2Pwkn23oH+Tcwtt65IFUv:PM+bfYeb8FFLn2vYfYeb8WFUv
MD5:	40E44F3220BCAAC377F8F6E0FBF80419
SHA1:	2B8B73499F6E4FBDA2BF6712E557DBC700262256
SHA-256:	A23550106654FC68D493278E41CFCE03A6B456FBADB42EE554D5718EB249137D
SHA-512:	CFE22ECFE20C3C809E2B9A9C0F2938922768752CB4C12F603C48585D1B5FB597B9F93A6CF33B3E64DA126B08EDF1DF54C7BA674E508B9CC17C94BDEC1609FDF5
Malicious:	false
Preview:	2024/09/06-12:04:00.696 1ca0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/09/06-12:04:00.712 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.177838776764898
Encrypted:	false
SSDEEP:	6:Pk7+RM1wkn23oH+TcwttYg2KLllkN6RFlyq2Pwkn23oH+TcwttNIFUv:PcurfYebJLnkulyvYfYeb0FUv
MD5:	6C9015EAB43756986731377C75F69667
SHA1:	24BFDAFADBFC1F37B78F4FC7F2CA004BEB3F4426
SHA-256:	E4D4D43FF5E3405D1052642778906F9923B56C092D3277ADB62A5D96AB092312
SHA-512:	6863484798E3675AF7D3487652BCA50F598D6F21D951524BB707F6F2915624694968E8EF6611534BD5232D29F7E307D4526595C434204A1D10C8541E1EF70456
Malicious:	false
Preview:	2024/09/06-12:04:01.325 1c74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/09/06-12:04:01.335 1c74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlcQ/lll:Ls3cQ1
MD5:	29249880815326219BDA909149851B00
SHA1:	69F3CCB595859AEC118C6CFB4F3B559B9CB94F9E
SHA-256:	1A8A85A2537CE5DCD0B19CA2992CDEF3E410D25D2678CB401F7F3D82F5FB6E03
SHA-512:	8E5D0D6220AA00F26EBE3E7A8C93B7B27FF52524A1265842A9D8912B4C1F8D303E19E9E41F7683286CF883665A3B6C7B467CB27B059A535755992672591D2563
Malicious:	false
Preview:	........................................S...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21917635620654863
Encrypted:	false
SSDEEP:	3:slBntFlljq7A/mhWJFuQ3yy7IOWUdel+/dweytllrE9SFcTp4AGbNCV9RUIT:EK75fO3el+/d0Xi99pEYV
MD5:	6C9D61DA299DE6D61EBB06A33D122B3E
SHA1:	35C8AF33A51B9B15F346A455261699E84DD30E93
SHA-256:	AD8BBD67674E8E217330EA55192912A12F2AD4F87992B08291CE9D389C649A55
SHA-512:	D16E503C59FF72915E284F9298D4C13F31CA4FC6D2E5B58EB982284F64CBC278BBB13FE0C56859322152FE9BB56B8BE3D3665CDEF30B3578DB12D9F170C4BAD2
Malicious:	false
Preview:	............8.[<...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.226698906340257
Encrypted:	false
SSDEEP:	6:PkkIRM1wkn23oH+TcwtRage8Y55HEZzXELIx2KLllkRlyq2Pwkn23oH+TcwtRagX:PIrfYebRrcHEZrEkVLnClyvYfYebRrcU
MD5:	E7069202194CAEA4476FD78D8799CC9E
SHA1:	16BFECE9E673DA685E6E001CA1238C4FC6E6E28C
SHA-256:	E73650E21029E1D22F31579387740A239689A63EB69DF300D1A11FF48F1076F3
SHA-512:	BC3E887DE522EC66F26150230029BD2DA324039837DB888CB48EFDCBA2A0B14BDE0D35D077754D5BE2E4BAD73F863660EA0FECFA5444AA4A915754AE755EF309
Malicious:	false
Preview:	2024/09/06-12:04:02.503 1c74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/09/06-12:04:02.517 1c74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.166874306203217
Encrypted:	false
SSDEEP:	6:PksU/s1wkn23oH+TcwtRa2jM8B2KLllkqtq2Pwkn23oH+TcwtRa2jMGIFUv:PtSfYebRjFLnLvYfYebREFUv
MD5:	6BDB9E1CBC8C2045E61A0BA6CE5672E4
SHA1:	F41C9D6223021CCE5F04A188C67B9E8DA8912C63
SHA-256:	C316C4A548DA7DBDEA040AD8A4CD22905AA24C371D2B9DD5BBC621C95E2EF033
SHA-512:	709FC1B4DE61675FB57326484E6303D22877C7037768E62E7C6144B2BECC090E31017C35436CD6B811498D2E5B7014D71481D67AF461D5B76EA50D77446EF6A4
Malicious:	false
Preview:	2024/09/06-12:04:00.760 1d70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/09/06-12:04:00.820 1d70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\11f2c852-d028-44dc-be99-578ef98df20a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\1f8166c6-b19a-47d3-b1af-bf5c711246bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\9cd032a9-bfa7-4902-a063-e993fafdf447.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3c092.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7607265187295861
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkig:uIEumQv8m1ccnvS6C
MD5:	A64CDF1F3B921B037CB4918C1713D94A
SHA1:	796416B39EEFF6B559753333DD48376A2C830381
SHA-256:	7BEEA1819D2E8A6213B0A5FBC79302023B4C70FFC686402AEBEB1F8D1E93D43E
SHA-512:	0F0D8A31D8FC8F77697E09BE024A072C7472E9E03B2C299BAE36E6138F57375D63A98147F5952A111101B381BA48C57D1065D0DA0F79CBF11725F60AA75999BF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF2a222.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\a65e28e6-3433-45c2-8d7d-2a5c56076cc1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\c454424b-59d7-4c7d-b2ff-8f35c34d8d21.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9690220173707145
Encrypted:	false
SSDEEP:	96:st0qf+Ois1ub9E0fN8zws85eh6Cb7/x+6MhmuecmAeagu+2Mg/EJ:st0jsKfNkws88bV+FiA5+PgMJ
MD5:	41317AEC604C140829ED851E7ACF6C26
SHA1:	8DA6A99D70779AF41222995A76D5368BEF7941AF
SHA-256:	6D515893F325C61F8012D6FD4D61978D5133C7CCEE8D736ADB6028691A0546A6
SHA-512:	625DF20560C77DABA1A789BA2ED10A2F10A2385C685A3E3E89865B3FE927BDB2B1A4331CF11C433A4866BFEF78045BEE1035A9F4FB7A3C4F891993F4474CD66F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370112240904179","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370112241064578"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF332f8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9690220173707145
Encrypted:	false
SSDEEP:	96:st0qf+Ois1ub9E0fN8zws85eh6Cb7/x+6MhmuecmAeagu+2Mg/EJ:st0jsKfNkws88bV+FiA5+PgMJ
MD5:	41317AEC604C140829ED851E7ACF6C26
SHA1:	8DA6A99D70779AF41222995A76D5368BEF7941AF
SHA-256:	6D515893F325C61F8012D6FD4D61978D5133C7CCEE8D736ADB6028691A0546A6
SHA-512:	625DF20560C77DABA1A789BA2ED10A2F10A2385C685A3E3E89865B3FE927BDB2B1A4331CF11C433A4866BFEF78045BEE1035A9F4FB7A3C4F891993F4474CD66F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370112240904179","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370112241064578"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF3a837.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9690220173707145
Encrypted:	false
SSDEEP:	96:st0qf+Ois1ub9E0fN8zws85eh6Cb7/x+6MhmuecmAeagu+2Mg/EJ:st0jsKfNkws88bV+FiA5+PgMJ
MD5:	41317AEC604C140829ED851E7ACF6C26
SHA1:	8DA6A99D70779AF41222995A76D5368BEF7941AF
SHA-256:	6D515893F325C61F8012D6FD4D61978D5133C7CCEE8D736ADB6028691A0546A6
SHA-512:	625DF20560C77DABA1A789BA2ED10A2F10A2385C685A3E3E89865B3FE927BDB2B1A4331CF11C433A4866BFEF78045BEE1035A9F4FB7A3C4F891993F4474CD66F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370112240904179","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370112241064578"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565287595487399
Encrypted:	false
SSDEEP:	768:WE4ryEoTWP4efAj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVji3D1rwdpGtuu:TWyEoTWP4efAju1jaKOD+qtN
MD5:	D5772F2A0A6322F26ED33704ADD731F4
SHA1:	CB0A8D6D8110D4E3A7AF17E2C30AF2031AE6A8E3
SHA-256:	31226E4822D247485D76108A8A6474C36216A125277AA0F3AB6599A4E7405EEA
SHA-512:	F031A78A6168185402386F1260260C7F5D5FEADBC99996C984BB1771F3727AC34349CB72695633A7389F0B0DBB8B5E1422777E4D94BDB92140F4BDF734EBE843
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370112240128858","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370112240128858","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF3012a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565287595487399
Encrypted:	false
SSDEEP:	768:WE4ryEoTWP4efAj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVji3D1rwdpGtuu:TWyEoTWP4efAju1jaKOD+qtN
MD5:	D5772F2A0A6322F26ED33704ADD731F4
SHA1:	CB0A8D6D8110D4E3A7AF17E2C30AF2031AE6A8E3
SHA-256:	31226E4822D247485D76108A8A6474C36216A125277AA0F3AB6599A4E7405EEA
SHA-512:	F031A78A6168185402386F1260260C7F5D5FEADBC99996C984BB1771F3727AC34349CB72695633A7389F0B0DBB8B5E1422777E4D94BDB92140F4BDF734EBE843
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370112240128858","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370112240128858","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.12968508654704
Encrypted:	false
SSDEEP:	6:PkU4BAs1wkn23oH+TcwtSQM72KLllkU4Uoq2Pwkn23oH+TcwtSQMxIFUv:Pd4IfYeb0Lnd4UovYfYebrFUv
MD5:	A9B3DD704ED822EEF8667EBAF295D669
SHA1:	2A77C9A10A85A412CB65174F9A4846CE36D93889
SHA-256:	771A1C1FBA469B74048E6FFDFD67D298C53E54894966F603D8B975945A890AEE
SHA-512:	7ED0FA42C3EB54EB0EB350DCE19C6FBFB0E75563273A8118FFC899684B5F66C021CDAA0E28997A54D51CAA8C1A07A03CD1170863CCBC6778CE99EA4925514EA0
Malicious:	false
Preview:	2024/09/06-12:04:17.187 1d70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/09/06-12:04:17.210 1d70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.05372640390481
Encrypted:	false
SSDEEP:	6:PkUs1wkn23oH+TcwtgUh2gr52KLllk1M+q2Pwkn23oH+TcwtgUh2ghZIFUv:P3fYeb3hHJLnj+vYfYeb3hHh2FUv
MD5:	01322E9AD650AC8FD329F14E0B9CA9C7
SHA1:	7F554BD58365A5E7698FA4B013D45A4E2ED36F10
SHA-256:	223B736E9D95F6F51FBED6DF31EC7BC214CC6649D58D7B334E535E853BC7A551
SHA-512:	BF81580E8717A1A9E231F47A67B0825A37915E3918CB82ACB7137BC2F48F206443E7542FEA28606EF73E7AA73FEB36FECE99948B8055F6469C5952CF46408444
Malicious:	false
Preview:	2024/09/06-12:04:00.161 1cac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/09/06-12:04:00.186 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.974937393114874E-4
Encrypted:	false
SSDEEP:	3:LsulZw/ll:LsTX
MD5:	27529D837426E8C685E368B76A3ABB08
SHA1:	34838587A2C71BD4FEBD9DF6803057CCA22A82A4
SHA-256:	F2633414B7984B2B4A24B13D6AAD71A4E9A595B59125C180F9597D80AD7DC50C
SHA-512:	EF274E3D1B5BD64B0297349100961F38EC70037C3DBF46C4CDD5ACBC0807AC8E24DC0EE4837DD325F77C818DB0ACE51C31B4DA35DB86892A19A10E48625A3820
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:CkqK0E0EJo9ln:C0Jo9ln
MD5:	264ACDB6BC68F41E975DB2B8E1C49F20
SHA1:	236084D491C91006289FC98810EF4414A89FAB09
SHA-256:	1616BDE0199319A3C36280278B34447CE54033F005600CB49404F62D33F60CD8
SHA-512:	DAB28E547343740E32C95EB9C9BD83393FED3F8642EFF61AAF71BAE559449CB48F6956888F66E68CB9F9149E15C0BDC9E75330F36D945B569EEBA5A5B8D97355
Malicious:	false
Preview:	(.......oy retne........................U...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:CkqK0E0EJo9ln:C0Jo9ln
MD5:	264ACDB6BC68F41E975DB2B8E1C49F20
SHA1:	236084D491C91006289FC98810EF4414A89FAB09
SHA-256:	1616BDE0199319A3C36280278B34447CE54033F005600CB49404F62D33F60CD8
SHA-512:	DAB28E547343740E32C95EB9C9BD83393FED3F8642EFF61AAF71BAE559449CB48F6956888F66E68CB9F9149E15C0BDC9E75330F36D945B569EEBA5A5B8D97355
Malicious:	false
Preview:	(.......oy retne........................U...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:SjK0X00ESv:S20XgA
MD5:	4DB9D2CE2C175B249B7F6F2B2C158254
SHA1:	88277EAE7CF76B5518BC664BD1D0DA5C5AFFAB97
SHA-256:	C5F6109B9BEE2483155A2D138F59D86DEBA6552E79B51FA371D9DDC40162A8F7
SHA-512:	F7D9C03966885FB6DA408E872E8395A1A9A6EE0BA857E6121CFA61707E387C8BAA56B42116FC67EB86B2E3678EB516128512B418E3960046B594E56F37B592E6
Malicious:	false
Preview:	(.....Luoy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:SjK0X00ESv:S20XgA
MD5:	4DB9D2CE2C175B249B7F6F2B2C158254
SHA1:	88277EAE7CF76B5518BC664BD1D0DA5C5AFFAB97
SHA-256:	C5F6109B9BEE2483155A2D138F59D86DEBA6552E79B51FA371D9DDC40162A8F7
SHA-512:	F7D9C03966885FB6DA408E872E8395A1A9A6EE0BA857E6121CFA61707E387C8BAA56B42116FC67EB86B2E3678EB516128512B418E3960046B594E56F37B592E6
Malicious:	false
Preview:	(.....Luoy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNllfll:Ls3N
MD5:	8B839D6F102E361D09580104B3897923
SHA1:	8276A04A8977D9732C4AA1F011FBF889EFB0CAC0
SHA-256:	06D36EAD9E8F24FAF089839972571C0040322EC714FA74CD6A6D9A616AA21863
SHA-512:	AA0EB07CF95B730F2E400DB6248C19138EA5712C50FE4DB62720F9D411154106960C9B32B5307813C90A2DBCFCDC9472147A3E838109A6B5B59ADD372AFD54C0
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNla/lll:Ls3a1
MD5:	FCE74EDCF9294F31323F8EDDB441259B
SHA1:	C3D4F7225FAAABA2244EE219A564B29F398BB259
SHA-256:	AAC11B530CA6D0CEF037DF7D990699BBDA96254A2F9E0925BBA677C6FD7C6164
SHA-512:	F71D997F791079D4A158A2DAE79537652BC74FADE0073A347311E39693D662014F78069A867986E713FEDFC5D81BBC69C4F4A50C5C24D85057E5251ACBF55175
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.223749184499407
Encrypted:	false
SSDEEP:	6:PkSds1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLllk3q2Pwkn23oH+Tcwt0jqEKj3K/M:PjVfYebqqBvFLn6vYfYebqqBQFUv
MD5:	B064C3011F7F1F8F21F0A5E55FC0DF39
SHA1:	8C8ABC27E2DA959D37D58C651580683B72ADA0AA
SHA-256:	D71CA47800D1D8D83CCD6A0DCB6190D1D8BA44C33D6D1EA58906FC669DEAC13E
SHA-512:	F86A75E0F221AB63D191FCE90A9ADB1C9C2764E3F4C00A94B0360A55D5E472E8C225D8715AA7D2FEFC3AE10B18393BF5EAC8CAFB44E459E039CF853F3EC9CABC
Malicious:	false
Preview:	2024/09/06-12:04:01.353 1d70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/09/06-12:04:01.417 1d70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\195d463d-93af-4fa2-b354-a7ee2d068c42.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2db1ee72-a483-405c-a089-681f21e4180d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\58af5806-448d-451a-ac0e-2961bc305bc5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3c0d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fa83c29d-2110-487d-85aa-af4727c861ee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.210756327392649
Encrypted:	false
SSDEEP:	6:PkU4Ys1wkn23oH+Tcwt0jqEKj0QM72KLllkU4J+q2Pwkn23oH+Tcwt0jqEKj0QMH:Pd4KfYebqqB6Lnd4MvYfYebqqBZFUv
MD5:	F82335C1D2FA42951E8357204E9943D2
SHA1:	41D90D16582A590EE5C6C01FB7896D78D24E2216
SHA-256:	677D343BD25E4D8FC131CC4E3B4C1B5D010FC23A893517FCC331759B579CDC25
SHA-512:	763708DB78A5F08E1FC96F245C618826D38906907E100A58B62C19ACA25E29F9DACB8B86A25F1B438362374721946AC8D710BCF4F53F61871CD552B572A65586
Malicious:	false
Preview:	2024/09/06-12:04:17.394 1d70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/09/06-12:04:17.673 1d70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.193896311260314
Encrypted:	false
SSDEEP:	6:Pkg3B1wkn23oH+Tcwtkx2KLllkuAq2Pwkn23oH+TcwtCIFUv:PifYebkVLnBAvYfYebLFUv
MD5:	29C22F1D76FE34DF102F6BD68682A43C
SHA1:	33198AE5CE62AF5F274B98594B2551EED8D888A2
SHA-256:	1C41E9EE40B2F2FD81DE436BB67FA3051AD10532B5BEFDCD827E4267C3732908
SHA-512:	23C94863BABA0B0E387CDCD3132080DA632A3BE5153DAECD507F38C04EA5B0DBEBDD6379A938E0DF1DEB0C08007925D881C2EAA34B84D82FCE18F4F9F527CCF2
Malicious:	false
Preview:	2024/09/06-12:04:00.128 1cb0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/09/06-12:04:00.423 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVzbKIzl:IiV3Tzl
MD5:	F30DFC484BDEB5DCD35B45A30B856BEC
SHA1:	6FBE926A15C91B595AFD58F9C3A2C3DF4C5AAB43
SHA-256:	34848F90A3E833E0CAB50956F699DAFDCCF583E0C8A8BFFE0715B87C25739123
SHA-512:	7935FB91AFE4315F9B7DBC0D186F6512BE2BACB2B1BD798CD296B48EB37B9EFA465005719F202CA1B526B12800FB39B3D798BCB16DE3640B6E0994F58972D9F9
Malicious:	false
Preview:	VLnk.....?........~..-..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0771919282558908
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOTtSAE+WslKOMq+vVumYFdn66:e/2qOB1nxCkOTtSAELyKOMq+vVumAp
MD5:	2A72D6A46F4DBA5553F725619B91A3C9
SHA1:	02481809E0631A4E98D977D04498C27E2C8B72F1
SHA-256:	649D783A9143037B67D378000D7D9450C71BC7242C3A3847237C44EB818B4A4D
SHA-512:	3C43E0766A9745F5B24BA2C7E9E86ACBBC11630E220632110C99F912B953A19AAF82B12D0730B1DB7DC1B28A354B8DAE12F9FBD6ECE7289685EBBCADE93E53F5
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\c59c50ad-eb2c-4929-b7bd-5329b85ac34f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	4.97888383191472
Encrypted:	false
SSDEEP:	96:st0qf+Ois1ub9E0fN8zws85eh6Cb7/x+6MhmuecmAeaSQx+2Mg/EJ:st0jsKfNkws88bV+FiAf+PgMJ
MD5:	8602BD9E7AEC38C7D69FED876694B94A
SHA1:	7C81A49DCD1FB563555AB2F53819DC1BED73EA05
SHA-256:	0936F929F327909CB836C9BB747E5B6D904CCBB3E7BC54BCF1DFD5FBBF73E5F4
SHA-512:	CD3D23583DEA91CA780C79E5578811469C2E4890D285CE02F9DCEB66B7E981CCA9A156380FCDD74194C32C5BEAE94644A237806AAE5736CB3A8048A52C193182
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370112240904179","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370112241064578"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ff2465a9-ed36-4200-80ac-50b6cf8a8fa8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.9764478580458595
Encrypted:	false
SSDEEP:	96:st0qf+Ois1ub9E0fN8zws85eh6Cb7/x+6MhmuecmAeazQx+2Mg/EJ:st0jsKfNkws88bV+FiAk+PgMJ
MD5:	628A9185B7CD7E5DEA2FDD1F5C44AE66
SHA1:	6F84F1B72760F3AE07918B97BB96398045F2FF37
SHA-256:	926C8258A3382992202F5DABC2B47E2766B0360720C49118C47D35AD061DDD2F
SHA-512:	6C042789B2E38B408D48FEA475B4B61E3462D0FAAAD0D1678727A9C94F67A11F2D000C4B1969521AF849E591ED184EA83CB29D51C47E6A82E5BBCCC1BAA5FC81
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370112240904179","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370112241064578"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/oOHG/lFll:7+/l/L
MD5:	6540E87C78187E0EA888965FFD31D5F1
SHA1:	3A185F7276267C60ECF271316464357E887FEA21
SHA-256:	F9C727E69B58BC408C2EBC267B6357DCF107F4E59C84AF1287079722EAF1785D
SHA-512:	60C2F0140AC872F74F58DC46FF05367A90D4859ECE5AEC98EF09BB6D8DE1B55A10705DFC5F95C6B1403FB6FD37E868F86026F19AFF18246E450AF085EF368CC5
Malicious:	false
Preview:	.... .c.......b.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.050059940109818395
Encrypted:	false
SSDEEP:	6:GLW0RfvtLW0RfnL9X8hslotGLNl0ml/XoQDeX:atvxt5GEjVl/XoQ
MD5:	C2126151AF3EDCE9491C8EFFE3080F59
SHA1:	3A8E932580A56744578C9872E110C45A0FF39A51
SHA-256:	CC40D131B5A38B50A9D7329A38E2E0F30DC429EF401FFAA9DE4167247A9E9C3E
SHA-512:	A4C463E72218299820CC5FC3C867F4470CC2CD8179C158F028D394E71217574484DCD4C45F523F19AAE9EA2C6FCDECB7AD87D03A47FE4CD03DB28B833A82ED68
Malicious:	false
Preview:	..-.....................(T.....a.}q.'6....4A.....-.....................(T.....a.}q.'6....4A...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9966019222059178
Encrypted:	false
SSDEEP:	48:fGzx7blO+scbX+Znn9VAKAFXX+kp02VAKAFXX+/xOqVAKAFXX+GznUYVAKAFXX++:f+x7j2ZkNsNNs5O5NsGyNs21
MD5:	384047DAB7D5F6E1B266B0697E26D1C7
SHA1:	A1F3E38D2E4B58EEE0C97CEB78C7673FE3AEC29B
SHA-256:	5769AF4C568E7696539941A0D18DE7D5788CC85FD6E85562193AB6D00C61EA1E
SHA-512:	82DA8601B57382B1EC54F7F5BEA5154B60A9943AD82BF0DFD7670C917897961CCF38E815DF3EA3532C04DCE5CA43EF3F62653600387E782908DA2C3B8EB047E6
Malicious:	false
Preview:	7....-..........a.}q.'6.Fd.t...$........a.}q.'6.......bFSQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.493471821791779
Encrypted:	false
SSDEEP:	48:RR8RSBSeQ9PwHRH2xEIYjIYmzGqkjMYjMY+qyFAlkfAlkL32:RT0eQKIYjIYmzGbjMYjMYSYcYe3
MD5:	A360AD3BB2F1759342FB5927B54D23EA
SHA1:	6BA9B4D3AC8E4B0A5994FB246A782EDD35C922B7
SHA-256:	FF985C153503F79CAD46D3318798A3684E65FEECB8FA25FC64189843CC8E1011
SHA-512:	6A9CCBA73A4C1CA938CBCD03A727B9E41AB759EFAC305225307FA82A6EC833481597181B13AA2B33363431EE3C2723AEB9CADDA4319A8BDF46DE49B8668EB7D4
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1K./..................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature......4_IPH_De

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.213117315060302
Encrypted:	false
SSDEEP:	6:PkUM1wkn23oH+Tcwt0rl2KLllkhoq2Pwkn23oH+Tcwt0rK+IFUv:P9rfYebeLnjvYfYeb13FUv
MD5:	7F85B204B5E16EDAB817EB50F77ED580
SHA1:	183FE9A78BC2DB15478CEEB1F45AAD0BB5AF5745
SHA-256:	3526FB196A4527B99A6D7F98DB678DCC6C6C1F5CE1068E4934DA6AB8E92BBDCB
SHA-512:	B90BCFA43848424C0D4EE62C791B734E4C9DE85D93A7D0D6F9E8254A6229E11B7B21CB65B565EBDB07ACE059B5B3E9A9DD3B3D958AEB20FA175614689670F431
Malicious:	false
Preview:	2024/09/06-12:04:00.935 1ca4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/09/06-12:04:00.962 1ca4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.958141412815535
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Wui+it/4JbZfPStub/RG0lbANqa:G0nYUtypD3RXi6FZfc25m
MD5:	FBC524D02048C176A0A5D1B8B752932A
SHA1:	294C48557549A4C978326D9B7969E293A024F157
SHA-256:	F3FC95AE128DB918FC126F15CD9D96618482BA6ACCC622AAA19B10CE80B15EA0
SHA-512:	9B6434442E11610B8B5DDA43AA56656599925C9C8F0A364DDB69D15B37A912D223EE600012468E0DB723CAF3546FFBDF56F085A0159EA7968BBACE894AAFF856
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....!....................3_.....n.b..................4_.........................37_.......`.................38_.....].$&.................39_.....4.9..................20_......R...................20_.......1..................19_......(...................18_.....:.=..................3_......W2..................4_.....)..>.................37_..........................38_.....h.#..................39_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.175417061047135
Encrypted:	false
SSDEEP:	6:Pk5OM1wkn23oH+Tcwt0rzs52KLllkMq2Pwkn23oH+Tcwt0rzAdIFUv:PGOrfYeb99LntvYfYebyFUv
MD5:	AFFAEACECF85F844EC05906129FCAC48
SHA1:	CB514BFBCF86F6E0D44BF3B9C525FFAD56F5E34E
SHA-256:	E925543D86B69EA3C72145A80C6891F2B662CD8AC933B5237F9AAB999DABB7B5
SHA-512:	8E6759D294A182C4AC0F22E288634914688269AF06654F6088A62BC80F37B329DF7D3B813EDB30A7ADC304EF9C7B291CD4A0925B5EDDC62E15602ACF2990DB28
Malicious:	false
Preview:	2024/09/06-12:04:00.908 1ca4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/09/06-12:04:00.933 1ca4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlhll:Ls3J
MD5:	3524FD88E434DCF6A3183739105D25BC
SHA1:	1013BB10520002C5A89CD9EB518BAD2A6876E001
SHA-256:	A46487361244D08054FB8EF2F9824288A627007868C3365748B26A7C86504C7A
SHA-512:	8274CF694D4EE0BEAF1695EA01E677EE90385C4DB0D663E996D7DF785741D7D28DFBECD31CBB780B88FA02EFC87CFE9B01434ACD04976B913CB79F7EDAD158F3
Malicious:	false
Preview:	.........................................<..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNliazxl/ll:Ls3ia9lX
MD5:	115205713D4E8637CCA88F6CF1B3FF81
SHA1:	5154BBDACE3112F41C102DA657E28BCE0CFB73EF
SHA-256:	92577AFF3FA9B5B8CE30E9A9D7BC7EC27ADA70451EF9BF8ABCB7FD0E1E42CF6E
SHA-512:	4C7FC527A9B108B086E8BA7EBE7F2EFC1767E9B474C4B2B061640BAF586470B7CD229F14134CC0F7F0BDA3F107589B1187276F602ADB0DE67AE4D767F6535B18
Malicious:	false
Preview:	........................................)...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518336973631551
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtI3Y8BDmoTbckSO9yike1JdXBuBuwBYak3aNhIx3XWQQRCYfYg:YuBqDPafS3l1NMkrZgBzBY9sIx3HB0
MD5:	892FF4620E48FEA4ABCE9231CE1B371E
SHA1:	FEC2D4C70F0E622480CD5036ED54CDDD9E7CBEDB
SHA-256:	D0B17635B3BA5D8A98FE729825F562C06426DC6F27AC3B03DAF6358C2542F824
SHA-512:	71CA3C17C3E887DC65368BD42B301C6106E725E1AAE35A6695116CAA6C38D3593FEC713CE00E006AE7CA61D6B3496A8D82680FB687B00CBFB30E11322342AFA3
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370112239440397","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725638639"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF29522.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518336973631551
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtI3Y8BDmoTbckSO9yike1JdXBuBuwBYak3aNhIx3XWQQRCYfYg:YuBqDPafS3l1NMkrZgBzBY9sIx3HB0
MD5:	892FF4620E48FEA4ABCE9231CE1B371E
SHA1:	FEC2D4C70F0E622480CD5036ED54CDDD9E7CBEDB
SHA-256:	D0B17635B3BA5D8A98FE729825F562C06426DC6F27AC3B03DAF6358C2542F824
SHA-512:	71CA3C17C3E887DC65368BD42B301C6106E725E1AAE35A6695116CAA6C38D3593FEC713CE00E006AE7CA61D6B3496A8D82680FB687B00CBFB30E11322342AFA3
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370112239440397","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725638639"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF29531.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518336973631551
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtI3Y8BDmoTbckSO9yike1JdXBuBuwBYak3aNhIx3XWQQRCYfYg:YuBqDPafS3l1NMkrZgBzBY9sIx3HB0
MD5:	892FF4620E48FEA4ABCE9231CE1B371E
SHA1:	FEC2D4C70F0E622480CD5036ED54CDDD9E7CBEDB
SHA-256:	D0B17635B3BA5D8A98FE729825F562C06426DC6F27AC3B03DAF6358C2542F824
SHA-512:	71CA3C17C3E887DC65368BD42B301C6106E725E1AAE35A6695116CAA6C38D3593FEC713CE00E006AE7CA61D6B3496A8D82680FB687B00CBFB30E11322342AFA3
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370112239440397","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725638639"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF29706.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518336973631551
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtI3Y8BDmoTbckSO9yike1JdXBuBuwBYak3aNhIx3XWQQRCYfYg:YuBqDPafS3l1NMkrZgBzBY9sIx3HB0
MD5:	892FF4620E48FEA4ABCE9231CE1B371E
SHA1:	FEC2D4C70F0E622480CD5036ED54CDDD9E7CBEDB
SHA-256:	D0B17635B3BA5D8A98FE729825F562C06426DC6F27AC3B03DAF6358C2542F824
SHA-512:	71CA3C17C3E887DC65368BD42B301C6106E725E1AAE35A6695116CAA6C38D3593FEC713CE00E006AE7CA61D6B3496A8D82680FB687B00CBFB30E11322342AFA3
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370112239440397","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725638639"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF297c1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518336973631551
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtI3Y8BDmoTbckSO9yike1JdXBuBuwBYak3aNhIx3XWQQRCYfYg:YuBqDPafS3l1NMkrZgBzBY9sIx3HB0
MD5:	892FF4620E48FEA4ABCE9231CE1B371E
SHA1:	FEC2D4C70F0E622480CD5036ED54CDDD9E7CBEDB
SHA-256:	D0B17635B3BA5D8A98FE729825F562C06426DC6F27AC3B03DAF6358C2542F824
SHA-512:	71CA3C17C3E887DC65368BD42B301C6106E725E1AAE35A6695116CAA6C38D3593FEC713CE00E006AE7CA61D6B3496A8D82680FB687B00CBFB30E11322342AFA3
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370112239440397","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725638639"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2bed1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518336973631551
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtI3Y8BDmoTbckSO9yike1JdXBuBuwBYak3aNhIx3XWQQRCYfYg:YuBqDPafS3l1NMkrZgBzBY9sIx3HB0
MD5:	892FF4620E48FEA4ABCE9231CE1B371E
SHA1:	FEC2D4C70F0E622480CD5036ED54CDDD9E7CBEDB
SHA-256:	D0B17635B3BA5D8A98FE729825F562C06426DC6F27AC3B03DAF6358C2542F824
SHA-512:	71CA3C17C3E887DC65368BD42B301C6106E725E1AAE35A6695116CAA6C38D3593FEC713CE00E006AE7CA61D6B3496A8D82680FB687B00CBFB30E11322342AFA3
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370112239440397","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725638639"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2fb9c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518336973631551
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtI3Y8BDmoTbckSO9yike1JdXBuBuwBYak3aNhIx3XWQQRCYfYg:YuBqDPafS3l1NMkrZgBzBY9sIx3HB0
MD5:	892FF4620E48FEA4ABCE9231CE1B371E
SHA1:	FEC2D4C70F0E622480CD5036ED54CDDD9E7CBEDB
SHA-256:	D0B17635B3BA5D8A98FE729825F562C06426DC6F27AC3B03DAF6358C2542F824
SHA-512:	71CA3C17C3E887DC65368BD42B301C6106E725E1AAE35A6695116CAA6C38D3593FEC713CE00E006AE7CA61D6B3496A8D82680FB687B00CBFB30E11322342AFA3
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370112239440397","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725638639"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF35005.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518336973631551
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtI3Y8BDmoTbckSO9yike1JdXBuBuwBYak3aNhIx3XWQQRCYfYg:YuBqDPafS3l1NMkrZgBzBY9sIx3HB0
MD5:	892FF4620E48FEA4ABCE9231CE1B371E
SHA1:	FEC2D4C70F0E622480CD5036ED54CDDD9E7CBEDB
SHA-256:	D0B17635B3BA5D8A98FE729825F562C06426DC6F27AC3B03DAF6358C2542F824
SHA-512:	71CA3C17C3E887DC65368BD42B301C6106E725E1AAE35A6695116CAA6C38D3593FEC713CE00E006AE7CA61D6B3496A8D82680FB687B00CBFB30E11322342AFA3
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370112239440397","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725638639"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF380aa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518336973631551
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtI3Y8BDmoTbckSO9yike1JdXBuBuwBYak3aNhIx3XWQQRCYfYg:YuBqDPafS3l1NMkrZgBzBY9sIx3HB0
MD5:	892FF4620E48FEA4ABCE9231CE1B371E
SHA1:	FEC2D4C70F0E622480CD5036ED54CDDD9E7CBEDB
SHA-256:	D0B17635B3BA5D8A98FE729825F562C06426DC6F27AC3B03DAF6358C2542F824
SHA-512:	71CA3C17C3E887DC65368BD42B301C6106E725E1AAE35A6695116CAA6C38D3593FEC713CE00E006AE7CA61D6B3496A8D82680FB687B00CBFB30E11322342AFA3
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370112239440397","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725638639"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3a7ca.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518336973631551
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtI3Y8BDmoTbckSO9yike1JdXBuBuwBYak3aNhIx3XWQQRCYfYg:YuBqDPafS3l1NMkrZgBzBY9sIx3HB0
MD5:	892FF4620E48FEA4ABCE9231CE1B371E
SHA1:	FEC2D4C70F0E622480CD5036ED54CDDD9E7CBEDB
SHA-256:	D0B17635B3BA5D8A98FE729825F562C06426DC6F27AC3B03DAF6358C2542F824
SHA-512:	71CA3C17C3E887DC65368BD42B301C6106E725E1AAE35A6695116CAA6C38D3593FEC713CE00E006AE7CA61D6B3496A8D82680FB687B00CBFB30E11322342AFA3
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370112239440397","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725638639"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF40694.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518336973631551
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtI3Y8BDmoTbckSO9yike1JdXBuBuwBYak3aNhIx3XWQQRCYfYg:YuBqDPafS3l1NMkrZgBzBY9sIx3HB0
MD5:	892FF4620E48FEA4ABCE9231CE1B371E
SHA1:	FEC2D4C70F0E622480CD5036ED54CDDD9E7CBEDB
SHA-256:	D0B17635B3BA5D8A98FE729825F562C06426DC6F27AC3B03DAF6358C2542F824
SHA-512:	71CA3C17C3E887DC65368BD42B301C6106E725E1AAE35A6695116CAA6C38D3593FEC713CE00E006AE7CA61D6B3496A8D82680FB687B00CBFB30E11322342AFA3
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370112239440397","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725638639"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlkfll:Ls3m
MD5:	366F803EAAA66EBB81C211137D3E3B62
SHA1:	F97FE7B976E3622CD369681B11211DB7F99DE418
SHA-256:	186FAFBEC2697B1C4FC12363DCFC205F734E17749FC8D59BF9BFB504878E54A7
SHA-512:	F2413EEE2F7AE97337493F3E0F50852C9C65090559392B9C7357F2286AD9C93C35E21820E1139D737968FE3580726DD594F018917D243C2CC69FCD503133BAA9
Malicious:	false
Preview:	.........................................F..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ba8831d6-3851-42f0-8f31-8cfde923bc45.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.579598615835296
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afS3l1NMkLZkHB+OdrxdKzvBY9H+tRxb6WbPaJkXHc7xwlRG1:Xq8NkC1fS3l1NMkLgBXzKzve9ebxbAJp
MD5:	DFC938A2930BF11DF065D026D7185632
SHA1:	A72B53146CB1BF3DF1D85E6AB69DA12137849002
SHA-256:	475C501EC7ED2C8B0FACBFE7BDE8EC61B77ED90863830112F8596F8E3995FD72
SHA-512:	17856546F54EB7C6D1C60740337DA1671828590E1AAB8F2E75118E4BBFE1D1E708E22AB4CA0B10B5F0183AD7A9A8DD8D8CD871564D5945E0EB8214E126860981
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADBrKrShUDYbaGAZwHxtWDDZZfho99DpJAeosfBbGggAAAAAAOgAAAAAIAACAAAAAHB8bXU/3HkmYru4Gh99Vp/k0YQIX0JC7MWv7bsk6BoDAAAABIbSnLLDW1ICt5f7Awwn+zNFibgs1edKVgfZwLJogzue2hbGJ2tQI78JnWg/5Nqm5AAAAA8qYh5xtIhsGL9KUFt7yS0h6lUhdQI9PpsaJpTDt8RQ0A7evXEZ4qNJLSpt9YukyfDNSYf66ILdaEjSkQdassfA=="},"policy":{"last_statistics_update":"13370112239480695"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\23b5d4d6-3339-442f-843f-4aa7732c74b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	59957
Entropy (8bit):	6.080142638994997
Encrypted:	false
SSDEEP:	1536:8MGQ5XMBGWaf8dP0SiwGKJU5GLK54MzlMXN2:8MrJM8XkdP0SnGKY4MzlMXN2
MD5:	BF9FF980A7B2C9DE0B663633D54F237F
SHA1:	6532FB01151A54FF136BC517B93C4BE3426DA590
SHA-256:	1F9EE0AF6BDEE2F131FFF6856952AC8DC2C82E65D04B13FFD5F9926059456280
SHA-512:	7B5F9222B30434B87380F867945E668C8A898AEFD16F4D1B1C1315D5D005CC385EBF489E585E79BF7E11B583BC005E7222D7C98A06722EE1F21B6B448C9CDA68
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370112256515897","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\32a98813-e012-4c69-a901-4398f5d172e4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8267
Entropy (8bit):	5.807498122083604
Encrypted:	false
SSDEEP:	192:fsNAa3XeiRUyT+Qhk3v76qRAq1k8SPxVLZ7VTiQ:fsNAa7R/S3j6q3QxVNZTiQ
MD5:	B19AA646F18097D07307031898D139B6
SHA1:	F568EF113DF499EE128B91539144F2E6E0D8F239
SHA-256:	91E53E972FEEF1FF727D962EF3E3B4839C87ABF43ECE933B5C0335092F385376
SHA-512:	2B6E745520661D0614EBBB3305A9E5DBE0BDD3E584F4DDAD4B95B45EE3654328F0152E0DFA2B0F7D8C205E3EA7EC3E48678BC0413F81DCC0FB88582F81E938B4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\73d10ee0-e898-4be4-ba87-455db329fdad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24700
Entropy (8bit):	6.05331956713504
Encrypted:	false
SSDEEP:	768:8MGQ7FCYXGIgtDAWtJ4nNwBMz3yS3xXN2:8MGQ5XMBGeMzCMXN2
MD5:	A7E789C494DB869390B0D061F85682C5
SHA1:	04793BCCBDD1C7FC61DDC975F088D93A356560A0
SHA-256:	55ACB046DAB36E34EBD9B1CF1826BACB96A99AE286B8A0BBBC7828D4F6104AA6
SHA-512:	498627832B5D5A1FCD025090E22551A244B62758EE4619BD06CDCCFB241D3045F1B042645FD0074064ED7BD3A98CC4576AEB6A40974C3CD0FC0AB32A58A10896
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370112256515897","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\74b3e6ce-de0d-4ae9-be5c-d3427170d65c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22018
Entropy (8bit):	6.059690787896531
Encrypted:	false
SSDEEP:	384:ctMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwoI0bS3CSDTx5JkjrKyqOn:8MGQ7FCYXGIgtDAWtJ4nwbS3CS3xXN2
MD5:	78158FE3513C7A4FF89FFE5D963FCB6C
SHA1:	C14A227921F6BF3B81402F01884B80F3BF8B3181
SHA-256:	EF1042284DE019D42E793E8F5BC0D80B71D90488B7C89A3ECCA65C80C3B36480
SHA-512:	1ED29F1AB80245F3A1AB5FAC2AC7F1260C716A13D4F9C6F1D5B57618B20C5A2CD73872DB1408AFDA1C66D69998FA9E95C522E13E6F7BEAEC378563EEFD559998
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370112256515897","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8758e39d-1f7f-4bfe-aa38-e2aa55a66c3d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9456
Entropy (8bit):	5.842669195553562
Encrypted:	false
SSDEEP:	192:fsNwa3XeiRUyEBxC/Uyyk3vi96qRAq1k8SPxVLZ7VTiB:fsNwa7WrCDx3K96q3QxVNZTiB
MD5:	10D3725C7356D18E02F65FCE75AF9251
SHA1:	8B2E04F585953CEF750173D6CF1F3582790210CC
SHA-256:	682370579D985C9F699F1E522D658E0D590B28A6FD47106BCAF80DE80855104F
SHA-512:	E8E26AED30767EADDB36BCCC97E43F01B01A0CC737822E1B66C8DC5FD63DB0168DD6B2B3D0C8BCB044829E9D26025E3A9693192E6E36FE9E62C72A256F595BB6
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8c276932-b5f1-4fe4-9820-a50cde95af57.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59918
Entropy (8bit):	6.080157059703623
Encrypted:	false
SSDEEP:	1536:8MGQ5XMBG3af8dP0SiwGKJU5GLK54MzlMXN2:8MrJM8KkdP0SnGKY4MzlMXN2
MD5:	F15FAF8A944E1BBB26868FFE0D18345C
SHA1:	560E0B9C6BDFFCEEBB5B142CC7ECF3D7E0D9C612
SHA-256:	D1C7E8EE9A56C62422ED4A678041B353B40994B0FFBC7ACE870103E4747494B3
SHA-512:	606E4D733341CAFEBF6DBDB7AC933A240D3D5681F9D17A7B904CC07AF069FA9246C6AD2D2B051FA916618161A4898B73F62E6D819FD9EBB431A9FEC58A81B0DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13370112256515897","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9148eb0e-0ecc-4256-9224-7549ec5727a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9440
Entropy (8bit):	5.84139620031919
Encrypted:	false
SSDEEP:	192:fsNwa3XeiRUyEBxC/x1Clk3t96qRAq1k8SPxVLZ7VTiB:fsNwa7WrCLC23t96q3QxVNZTiB
MD5:	0DD7E8783D9FAE5E8C96AC8CEE58EFCE
SHA1:	513A94697BDF3CFB6C79F01242AA91D2C009115E
SHA-256:	9FBC4D4109FD2DBE2B6C32DF44EDF94770475888952D2D6661B0293787BA3FB7
SHA-512:	39637D629492CFAA8CB64AA8F60D137DE301A87FD8F9679B69F3BD5205356B50AB539B96235C0BA832DB5FA62D094390E06CCA108F6FD2C59D175FA75689D3C2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\5b8b91ce-a32c-4580-993c-75a1ccc47cf5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66DB27FF-230C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.30942840133632515
Encrypted:	false
SSDEEP:	3072:E/9Mt5Acq4FBIJPP1QSPMMIqAGHHk60wPOAm7JeQ8CloB9nYFdQqqs67f54Ic972:9IrvHHKwP6Shc9HaH/sw
MD5:	26B789E99653BDC6B8FA30C0DD47B5CA
SHA1:	B2F87EAD1B9980A9DB4252EEC8909C44350A5E73
SHA-256:	E22CA78FE7D5A5DCC27FA3083329ACA116AEF935DCFC8DB236AD9A25368E2F4B
SHA-512:	E55564CDC33ABE32F3FEEE5518E7FEA4030CC7B302554EDD5E06A8ADD4DE0207451912F7958A0C3ECB52D21CCBC708B1F56A0031391189B83D35B383E0BCCA71
Malicious:	false
Preview:	...@..@...@.....C.].....@................6...6..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".euvbab20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66DB2808-1FB8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03975427235223449
Encrypted:	false
SSDEEP:	192:vY0EbtmqvDtKX7xJEa3XxxTVwg7XDiV0DA5DhAVN/K+O1gQtEedKTq01n8y08Tcp:w0EtmeQtGnhUHagCdGX108T2RGOD
MD5:	C10DA433AA1F095FFA67428C9D9B3871
SHA1:	ADCE92009A0A75D82E6F57E97F226513D98637BA
SHA-256:	E4F52C24DA2CC83458ADA9EC9337BB852BF4F9BFCDD5DCD8B31A0CD97DC31C77
SHA-512:	15430108B87009D41E48E4C38FC06F7297DC4E215A10A48CE6CDE7D37AFB2CEDA16545AC6B08082DAE66D912504800AB22A60DF5FD7B2CE5D5D1581970F885B7
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".euvbab20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66DB2810-2360.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.038889100586627014
Encrypted:	false
SSDEEP:	192:LY0EbtmqvD3KX7bJEa3Xxx7UpXxgg6zfhj1NEJ3Gtxxm1gQ8RVlFq2n8y08Tcm2D:E0EtmeZVQh5mWzigNV/h08T2RGOD
MD5:	DD6F5C3613D6A59C9A1A1A45B6F9F67F
SHA1:	16F0C7CE6B00477D7419EA940133AB2EEF64623C
SHA-256:	624A91F40D43AC5C90DC5B5D8F2452447E1F5175CC03D8118E3A1FCF5F7D1DDA
SHA-512:	4B51B98AD53A7D91614D76E5D61851D755734C851F1EB4870E97C18024AFFD370A26A6E14D3E45A3042B290EFDD682387561FE1ABFFF0720F0C6BB92CC806919
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".euvbab20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66DB281D-1C08.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03883042372206465
Encrypted:	false
SSDEEP:	192:km0EbtmqvD3KX7eDJEa3Xxx7UpXxgg6zfhj1NErZGtB1gQMpcO9Tq2n8y08Tcm2D:B0EtdDeZVQh5WWDgNcUh08T2RGOD
MD5:	C2E96F61B417CE54125FCCAA54F9EB4E
SHA1:	1F4813E67DC1B0F59861ADDDCE445F134A180F40
SHA-256:	43A06C329B8710B11F5B9F78A51D960B21AA536977C0CC8184EE83835C04B4F7
SHA-512:	7089C9514933C091D099EC663514754563A8EC78511C236B336EA5F62468FC3B4A13EED6DC3D2DA1D8CB6463A4972379345DCD427BD3EC4FA4F3FCE4D9F18366
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".euvbab20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\269741b2-38d0-4e36-934f-05ca6cdb386b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.564804764148489
Encrypted:	false
SSDEEP:	768:YJxNO07pLGLvSjWPA6fYC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSNdLsz8rwq3pz2:YJxNO4cvSjWPA6fYCu1jaTNdoz14tk
MD5:	04056150367029321B3300089B744172
SHA1:	4F38AD4CAB2672F796FB7D0F43F4EA46FD5F73FB
SHA-256:	CC5C75A5717C7C5ACDF0499D4427F9DF0BB4103E01628FADE0667FC25C30EE51
SHA-512:	2C2F28BB3B2DEEBA9E3BEF616C150AADA7BBE3802BB3308DE5716D3CD8C3852DEA7375A4494EEF5F1654F041195358B2C597278E1C7D182B3A83FE3CBB2B7DC3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370112256230014","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370112256230014","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\65ca32be-620c-4da9-bc9a-fbba932aa2c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\91109f42-d285-48a8-9cad-2defbd549103.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9aca7ac6-f209-48ab-9208-3cc76dab2a97.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9335
Entropy (8bit):	5.177445717569025
Encrypted:	false
SSDEEP:	96:sV7qlHJ1Wb9207dXzT8dgBxYisY5Th6Cp9/x+6M8muecmAeCuwKe4zvrB2X6gE5F:sV7IJk7dsgBxYisYPpj+FVAktBFBf
MD5:	A77B31C01CDA79AACD71906588B6FB0D
SHA1:	0B12CDE97D11695EA796644608CB48EC1C8C6405
SHA-256:	F7A6C73FA1E3C200DD5C934A06A3C250992F24286AEF7B5A65868EDDF06DA735
SHA-512:	D29FD3ADCE54E6DF778ED0172CABEA0C07009630B2FAE7346307FAEB0D3606D84DB912317599594072D0CBB1B0EFC40E06D1BD0328B291B68304AF9BB439825E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370112256461636","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.318975547330839
Encrypted:	false
SSDEEP:	192:35AOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:yOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	427E0FA05F1A67CDABEE233448B66B72
SHA1:	9257FBE1C97F9B13656854FD75393866DB642973
SHA-256:	F8F5EE5E8A0C8FAFA35C6E340412DDB8E9F9030627F83B933114BE50A208E6FF
SHA-512:	7F278ADE6D17A5C9F3089146422F24AF8EDEE142E0C89F08EF68CEED529B715AB5A7B495F9E2F15CC825D8EF0E972545C8698B2D03586DABC0F7AAEBA6E9FC6C
Malicious:	false
Preview:	...m.................DB_VERSION.1gKV_.................QUERY_TIMESTAMP:arbitration_priority_list4...13370112259203108.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.085351796388167
Encrypted:	false
SSDEEP:	6:PkU42Jhq1wkn23oH+Tcwt9Eh1ZB2KLllkUwt+q2Pwkn23oH+Tcwt9Eh1tIFUv:Pd42JLfYeb9Eh1ZFLndwovYfYeb9Eh1b
MD5:	4E54C2A9F5578C21EA6408CAB448DB4C
SHA1:	2C52B594CF2A268D753F6120A4405A4AB5CA8E55
SHA-256:	3467E0AD8BF9345DBC0861F79BB23583463C59A01C4AA38B23C0694A7EFC8C32
SHA-512:	05ACEB34DCC3B7ACC9B359DD567757305EF18725C88E5CC0F65258A38165A871C68ACA29E5ED05FEC4992AB9EB773BA4CCB7D6CC20897E259B56809C6FBA3BB2
Malicious:	false
Preview:	2024/09/06-12:04:17.966 20c8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/09/06-12:04:18.002 20c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlCuQlll:Ls3CZt
MD5:	F2FF4D19FBC47491B41C2BDFCEAE221F
SHA1:	DD1F24FEAF2DEC49C48107215A28FF40C1A8FF80
SHA-256:	5E3308BF6E0586D890DAFF25BE6914F7978ECAE549FC75902EA6D444EB67DDA6
SHA-512:	EE28AE02BB77D915EC969982BECF26A0B7604F182D3671B0019BB8C3EAFCD402D86DC62BE76C3EB3B5D3B1C273B2652B454EC96D5B1C213C4FF4CBCA10D896D2
Malicious:	false
Preview:	........................................[...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.207224100857938
Encrypted:	false
SSDEEP:	6:PkUb1wkn23oH+TcwtnG2tbB2KLllkUwG3+q2Pwkn23oH+TcwtnG2tMsIFUv:Pd6fYebn9VFLndz3+vYfYebn9GFUv
MD5:	D1AFC0B2026236F13755443F19E48546
SHA1:	BB8444FACEEFD45D7BA55E38B5201E89C4ABB64C
SHA-256:	515D7823C94D6611960C6062997DDDAA1F3B7200CACD2F03043B79FE3220761B
SHA-512:	42EE859DBF915D294C97A51E9C3C3DC85A294F360AF44B7D9D27BC646EA4566FDC0F3857DA09DC1926181F03301E196E0C5782B3F80C22361901CB7BBEAE362A
Malicious:	false
Preview:	2024/09/06-12:04:16.589 23dc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/09/06-12:04:16.604 23dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.142637286445651
Encrypted:	false
SSDEEP:	6:PkU61wkn23oH+Tcwt8aVdg2KLllkUi8vIq2Pwkn23oH+Tcwt8aPrqIFUv:PdFfYeb0LndjvIvYfYebL3FUv
MD5:	292E5066105B200FCD55ABD6084CE1FD
SHA1:	AF59EDA94990D07049F4DC1E6277C24572EE087D
SHA-256:	BFAC24AEF819A22FF811DD6AE62830F51A38DEA4389D57C3C8C1FD0D85B17526
SHA-512:	CD8391E3BF6660BDA44B150A163F4C2EF7E5297A00D00CC58376F254EB10141B3F15CCF2B036B57B10799EB7B53A33BC842B206ED213EA404F7CD95E2636194C
Malicious:	false
Preview:	2024/09/06-12:04:16.261 23e0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/09/06-12:04:16.277 23e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.141047222100881
Encrypted:	false
SSDEEP:	6:PkUu0q1wkn23oH+Tcwt86FB2KLllkUSo24q2Pwkn23oH+Tcwt865IFUv:PdtfYeb/FFLndFVvYfYeb/WFUv
MD5:	3A41BA196EDAE40BCDB1FD79ADC59AE0
SHA1:	3ED105D666F5D3291505E0E0D690314423746ECF
SHA-256:	CC29A7A9FC76105864721E0CDB3AED4AFEBFF101FD980B87D5121282929BDBD3
SHA-512:	3C051D4F0779BB3799B6C5657712EE9CE0E711F5A01238689B1FD83BE21F64817FABEB29D69A6898A694C1BB36E45C8BB23CDA4CBEBECBBC62A175D88EC75D15
Malicious:	false
Preview:	2024/09/06-12:04:16.346 2390 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/09/06-12:04:16.416 2390 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.165117549968125
Encrypted:	false
SSDEEP:	6:PkUGtr4q2Pwkn23oH+Tcwt8NIFUt82kU5JZmw+2kUm3DkwOwkn23oH+Tcwt8+eLJ:PdGtsvYfYebpFUt82dT/+2du5JfYebqJ
MD5:	88FE7D6B62B895C2B6E551237B63D845
SHA1:	98E16398A3C9BF17B36E6F8B58D355CEF6EFDD76
SHA-256:	B71375A24B8EB9883F6AA653E9B4D7B3402257DAD1AD103451541C4D787AEA3F
SHA-512:	F23C596AD40688813DF2BCCEBE253BFBDF0593F3BB4BEBDC5B23C71703A53F84DFC91D7360BC815C3E485811AA15277F58203BD36A84502F3D0E2830F41F72E4
Malicious:	false
Preview:	2024/09/06-12:04:16.559 2390 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/06-12:04:16.561 2390 Recovering log #3.2024/09/06-12:04:16.562 2390 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.165117549968125
Encrypted:	false
SSDEEP:	6:PkUGtr4q2Pwkn23oH+Tcwt8NIFUt82kU5JZmw+2kUm3DkwOwkn23oH+Tcwt8+eLJ:PdGtsvYfYebpFUt82dT/+2du5JfYebqJ
MD5:	88FE7D6B62B895C2B6E551237B63D845
SHA1:	98E16398A3C9BF17B36E6F8B58D355CEF6EFDD76
SHA-256:	B71375A24B8EB9883F6AA653E9B4D7B3402257DAD1AD103451541C4D787AEA3F
SHA-512:	F23C596AD40688813DF2BCCEBE253BFBDF0593F3BB4BEBDC5B23C71703A53F84DFC91D7360BC815C3E485811AA15277F58203BD36A84502F3D0E2830F41F72E4
Malicious:	false
Preview:	2024/09/06-12:04:16.559 2390 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/06-12:04:16.561 2390 Recovering log #3.2024/09/06-12:04:16.562 2390 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.32872990409968056
Encrypted:	false
SSDEEP:	6:xA/J3+t76Y4QZZofU99pO0BYhlaqR4EZY4QZvGw:ShHQws9LdilhBQZGw
MD5:	21E50EEDACB8BA61743DAEA9E02D1C44
SHA1:	AD0F68056D55CD7D8FD33D5721A4985904734B63
SHA-256:	8367AA254FD0FBB53C8587B26C2DFB236F665CCC5C980A041E7BABA58D99E0AB
SHA-512:	66A3522E1FC29A2284A1F3463594CD29AF3B5A56E7A4CABC42FF79981124BBE692DD420981FC13213E43505EC7F6777C6C367C53E98D54E903AE17684BC023A7
Malicious:	false
Preview:	............+.z....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.286965223865223
Encrypted:	false
SSDEEP:	12:Pd4d41yvYfYeb8rcHEZrELFUt82d4ddJ/+2d4dd1R5JfYeb8rcHEZrEZSJ:1OvYfYeb8nZrExg8CO1OnJfYeb8nZrE8
MD5:	59FF7B891759F507DC63F599F2E92851
SHA1:	EDD68EE0CF5570749CA03FB3AD13D18E632C9FE2
SHA-256:	B39ECD32535CC4A39B40441EEF7A9290F200D2F43164D6781F36E3EE93A1E340
SHA-512:	674D5C2F02FADEDB52CDC2665370A1718B912045A2E53B40788F67194D5C22688A7938FF4E9B15703BF13100F76CB5AE27F6CB96482B034E1B970D211AA52C8E
Malicious:	false
Preview:	2024/09/06-12:04:17.647 23c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/06-12:04:17.648 23c4 Recovering log #3.2024/09/06-12:04:17.648 23c4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.286965223865223
Encrypted:	false
SSDEEP:	12:Pd4d41yvYfYeb8rcHEZrELFUt82d4ddJ/+2d4dd1R5JfYeb8rcHEZrEZSJ:1OvYfYeb8nZrExg8CO1OnJfYeb8nZrE8
MD5:	59FF7B891759F507DC63F599F2E92851
SHA1:	EDD68EE0CF5570749CA03FB3AD13D18E632C9FE2
SHA-256:	B39ECD32535CC4A39B40441EEF7A9290F200D2F43164D6781F36E3EE93A1E340
SHA-512:	674D5C2F02FADEDB52CDC2665370A1718B912045A2E53B40788F67194D5C22688A7938FF4E9B15703BF13100F76CB5AE27F6CB96482B034E1B970D211AA52C8E
Malicious:	false
Preview:	2024/09/06-12:04:17.647 23c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/06-12:04:17.648 23c4 Recovering log #3.2024/09/06-12:04:17.648 23c4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.160570812179017
Encrypted:	false
SSDEEP:	6:PkU4nfyq2Pwkn23oH+Tcwt8a2jMGIFUt82kU4HB41Zmw+2kU4BVOgRkwOwkn23oL:Pd4nfyvYfYeb8EFUt82d4A/+2d4BHR52
MD5:	60C5947DDC2CDD7F5B30161CF7FBE47B
SHA1:	87123DB7A0228CE148ACFBF14DC628A6815C016E
SHA-256:	15E40AD3139580ACFB6F70FB8F4E954EBBEFFE31A5DAE15FECC0489ADA1354BF
SHA-512:	9D1D575ECA03E09083D060830111325209595B8918E28AF92B42A9E66A21D63ED1045B1ED389B2C0EC97EC93C4F8826E5246CDDFDA1C90515FA15836F16CF0F7
Malicious:	false
Preview:	2024/09/06-12:04:17.181 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/06-12:04:17.225 1de4 Recovering log #3.2024/09/06-12:04:17.240 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.160570812179017
Encrypted:	false
SSDEEP:	6:PkU4nfyq2Pwkn23oH+Tcwt8a2jMGIFUt82kU4HB41Zmw+2kU4BVOgRkwOwkn23oL:Pd4nfyvYfYeb8EFUt82d4A/+2d4BHR52
MD5:	60C5947DDC2CDD7F5B30161CF7FBE47B
SHA1:	87123DB7A0228CE148ACFBF14DC628A6815C016E
SHA-256:	15E40AD3139580ACFB6F70FB8F4E954EBBEFFE31A5DAE15FECC0489ADA1354BF
SHA-512:	9D1D575ECA03E09083D060830111325209595B8918E28AF92B42A9E66A21D63ED1045B1ED389B2C0EC97EC93C4F8826E5246CDDFDA1C90515FA15836F16CF0F7
Malicious:	false
Preview:	2024/09/06-12:04:17.181 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/06-12:04:17.225 1de4 Recovering log #3.2024/09/06-12:04:17.240 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\126588db-ace3-4080-844d-04d085e33b3d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2f875147-9535-4e97-baf2-3c99673c6df2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5405ff2c-0083-4955-bb78-28a855070fa8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8f4020e3-5503-4294-9c5a-f02be51e603d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\96eaf2ae-7ece-4649-beb0-62098432f1cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3038b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3f03d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2dd94.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2e7b6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF3038b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d5974024-c350-4f19-ac8d-29e9b24a95cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.304541667434837
Encrypted:	false
SSDEEP:	24:YXslUZVMdBsl4XZFRudFGcsl3AJZFGJ/dbG7nby:YXsm8s6JfcdsNugzbZ
MD5:	6832AA306727DC6AB91C04A3BEDD8F42
SHA1:	E084A2F73A6ACD5BFF35AB5757F4E4C012D4A0E4
SHA-256:	70C6039B9DA8F1CE66C7F5F918F6FB1252AA935E6C29EFBD0BDC490CA5A1BEA5
SHA-512:	7564984871B441CC587813E680FFD4499C93F880FAC1424E27090A6F695517024DB24F56A7DDA28252AE6C14D8852A86A497E1C0E8332A7D2BD49699186F8F2B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372704258547103","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372704259525777","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372704261796831","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1d2eb89-cb14-4eaa-89a3-3aac8fe7aa74.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.055755502766053
Encrypted:	false
SSDEEP:	96:sV7qlHJ1Wb9207dXzTOYisY5Th6Cp9/x+6M8muecmAeCIne4zvrB2X6gE5AtEHb:sV7IJk7d2YisYPpj+FVA+NBFBf
MD5:	571C084D05E00D549F73CD3A5C0955CA
SHA1:	ACA80C7893AA992658306C12D17985E7DBAC2930
SHA-256:	E5A030EF9242D051E9560C34E41B96CDDA9369888CFC98BFFFA8FB634F62E308
SHA-512:	9B6E9B5CE06EB8CF4FA177C28D4E842D8B8637F378348408B919D6667F808632BB5DE35E8679C91492A5B0CC1A61A09A7A448246225E9EF059BB51B4F6B27C69
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370112256461636","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF35862.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.055755502766053
Encrypted:	false
SSDEEP:	96:sV7qlHJ1Wb9207dXzTOYisY5Th6Cp9/x+6M8muecmAeCIne4zvrB2X6gE5AtEHb:sV7IJk7d2YisYPpj+FVA+NBFBf
MD5:	571C084D05E00D549F73CD3A5C0955CA
SHA1:	ACA80C7893AA992658306C12D17985E7DBAC2930
SHA-256:	E5A030EF9242D051E9560C34E41B96CDDA9369888CFC98BFFFA8FB634F62E308
SHA-512:	9B6E9B5CE06EB8CF4FA177C28D4E842D8B8637F378348408B919D6667F808632BB5DE35E8679C91492A5B0CC1A61A09A7A448246225E9EF059BB51B4F6B27C69
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370112256461636","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3e725.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.055755502766053
Encrypted:	false
SSDEEP:	96:sV7qlHJ1Wb9207dXzTOYisY5Th6Cp9/x+6M8muecmAeCIne4zvrB2X6gE5AtEHb:sV7IJk7d2YisYPpj+FVA+NBFBf
MD5:	571C084D05E00D549F73CD3A5C0955CA
SHA1:	ACA80C7893AA992658306C12D17985E7DBAC2930
SHA-256:	E5A030EF9242D051E9560C34E41B96CDDA9369888CFC98BFFFA8FB634F62E308
SHA-512:	9B6E9B5CE06EB8CF4FA177C28D4E842D8B8637F378348408B919D6667F808632BB5DE35E8679C91492A5B0CC1A61A09A7A448246225E9EF059BB51B4F6B27C69
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370112256461636","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5569679589015895
Encrypted:	false
SSDEEP:	768:YJxNO07pLGLvSjWPA6fjC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOLsz8rwYp3pztF:YJxNO4cvSjWPA6fjCu1jafoz1YLtF
MD5:	9C6F9CD5FAD77D44BAA41AF922B21097
SHA1:	F8873DAB40C430EFC02511338CFDD8BC8E278ED2
SHA-256:	6CA45462B82FB3135F7AA96C0D385EE0FCE9A33899C77DE192A879CF091C04B7
SHA-512:	44A86217574A12F7255860EECB1D0FECA7570EF74096CE4C0D2BD0E49F7D97582B3B24DF50A249C873699AB8F61FE0738508FF0B52E906C920824F86DDA77131
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370112256230014","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370112256230014","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF33c6e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5569679589015895
Encrypted:	false
SSDEEP:	768:YJxNO07pLGLvSjWPA6fjC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOLsz8rwYp3pztF:YJxNO4cvSjWPA6fjCu1jafoz1YLtF
MD5:	9C6F9CD5FAD77D44BAA41AF922B21097
SHA1:	F8873DAB40C430EFC02511338CFDD8BC8E278ED2
SHA-256:	6CA45462B82FB3135F7AA96C0D385EE0FCE9A33899C77DE192A879CF091C04B7
SHA-512:	44A86217574A12F7255860EECB1D0FECA7570EF74096CE4C0D2BD0E49F7D97582B3B24DF50A249C873699AB8F61FE0738508FF0B52E906C920824F86DDA77131
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370112256230014","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370112256230014","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.13843193696724
Encrypted:	false
SSDEEP:	6:PkW3WMyq2Pwkn23oH+TcwtrQMxIFUt82kW3cC1Zmw+2kWWRkwOwkn23oH+Tcwtrb:PP1yvYfYebCFUt82PcU/+2eR5JfYebtJ
MD5:	82CCE699B83E69B254E37C5BFA2B82C1
SHA1:	76A0C64425DF1C319FE02BEB75E302C57EBFF17E
SHA-256:	F857770E86623327DF246E26FB533440A16D64310D7B052C3E9741CBF6008538
SHA-512:	7210B6F7D149DC714D4366BA38DE8D9FADB1F03B26E6C2BAC435183FC4B9397D6829E4790D24FA29F65E22D15357046854ED34402A9AD1A5F627E559960F6EDD
Malicious:	false
Preview:	2024/09/06-12:04:32.639 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/06-12:04:32.691 1de4 Recovering log #3.2024/09/06-12:04:32.717 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.13843193696724
Encrypted:	false
SSDEEP:	6:PkW3WMyq2Pwkn23oH+TcwtrQMxIFUt82kW3cC1Zmw+2kWWRkwOwkn23oH+Tcwtrb:PP1yvYfYebCFUt82PcU/+2eR5JfYebtJ
MD5:	82CCE699B83E69B254E37C5BFA2B82C1
SHA1:	76A0C64425DF1C319FE02BEB75E302C57EBFF17E
SHA-256:	F857770E86623327DF246E26FB533440A16D64310D7B052C3E9741CBF6008538
SHA-512:	7210B6F7D149DC714D4366BA38DE8D9FADB1F03B26E6C2BAC435183FC4B9397D6829E4790D24FA29F65E22D15357046854ED34402A9AD1A5F627E559960F6EDD
Malicious:	false
Preview:	2024/09/06-12:04:32.639 1de4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/06-12:04:32.691 1de4 Recovering log #3.2024/09/06-12:04:32.717 1de4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.199682595459037
Encrypted:	false
SSDEEP:	6:PkUmq2Pwkn23oH+Tcwt7Uh2ghZIFUt82kUStQZmw+2kU38zkwOwkn23oH+Tcwt7w:PdmvYfYebIhHh2FUt82dSu/+2d38z5J8
MD5:	7105018EA74D607848B7CC6F863A0E39
SHA1:	A2932AE013D64DFB6783FA8AF75B13B23C249B5C
SHA-256:	3B945776FCB7332EF27D3362C4FB4A5DE44E9FF95D4FD7531DCF426237699762
SHA-512:	498D0BB936212529FC9E9A9048D6B179C78ACFCE79DFA0AAA1CAE9A1D096347BC28D5ABD55B0A2982474E956B968B3E4DB66740520CA2E32C34BBAA8858DD1DC
Malicious:	false
Preview:	2024/09/06-12:04:16.449 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/06-12:04:16.577 23b4 Recovering log #3.2024/09/06-12:04:16.578 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.199682595459037
Encrypted:	false
SSDEEP:	6:PkUmq2Pwkn23oH+Tcwt7Uh2ghZIFUt82kUStQZmw+2kU38zkwOwkn23oH+Tcwt7w:PdmvYfYebIhHh2FUt82dSu/+2d38z5J8
MD5:	7105018EA74D607848B7CC6F863A0E39
SHA1:	A2932AE013D64DFB6783FA8AF75B13B23C249B5C
SHA-256:	3B945776FCB7332EF27D3362C4FB4A5DE44E9FF95D4FD7531DCF426237699762
SHA-512:	498D0BB936212529FC9E9A9048D6B179C78ACFCE79DFA0AAA1CAE9A1D096347BC28D5ABD55B0A2982474E956B968B3E4DB66740520CA2E32C34BBAA8858DD1DC
Malicious:	false
Preview:	2024/09/06-12:04:16.449 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/06-12:04:16.577 23b4 Recovering log #3.2024/09/06-12:04:16.578 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulFUK/lll:LsOt
MD5:	1898E48908F77DAF3C3B6569F6F68530
SHA1:	B11C74D7E93AED5300575590E6D395A8BD8CFFED
SHA-256:	4F30E572DAF2B4F0BFC7DBF6AD2CA7B61F2E8F6FC397FE2B29C1F8D1CCCCA7E0
SHA-512:	F33E6A2528227C88C92515F6EE707D48764054FE8EBDD2813710A0A57EFBAD760F2D0D6FECF8A34A758B48D9CDC707A6C7270A01F408ED0DE7CF426E3FB9F3A8
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlx1lKtll:Ls3te
MD5:	0F30EDAD6A262F3D8234279AC44C56A1
SHA1:	5067F1F22E4B413250E4CDA028E1E1E413DFCC83
SHA-256:	B567DCFD3A29FA25E085458405CE107CA0A53E392AEA62E2AB1E2FD62AAB2FA1
SHA-512:	FBE98F0F3F189C70E49C1F18E1D85625FB4A45B1A6E3D17E6D6D0774439CFB577DF69B1B6AE96107FABD83872F9342B7FF51C0ECBC24CB1A66D3A5D7E2BDFFA7
Malicious:	false
Preview:	............................................./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.226495835912625
Encrypted:	false
SSDEEP:	12:Pd4ZL+vYfYebvqBQFUt82d4VW/+2d4dLV5JfYebvqBvJ:1+YYfYebvZg8CYaiDJfYebvk
MD5:	258F1E0D6D21828A0E826024905B1155
SHA1:	1ECDB64EC23ED8C2E4D970C924E986E973EB3C33
SHA-256:	2524607227759EC41E521E9BE4FA8D7BB0A1D9EC79D1A160AFCB06D0727ECD34
SHA-512:	F0339139809C42181754FEAF1478C23A6327C27E85359E629E1AABA317FB5349A25931143D11283FF5FA9768BF791656C00ACE1D5724E0933CB5345BE131FD37
Malicious:	false
Preview:	2024/09/06-12:04:17.251 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/06-12:04:17.252 20ec Recovering log #3.2024/09/06-12:04:17.255 20ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.226495835912625
Encrypted:	false
SSDEEP:	12:Pd4ZL+vYfYebvqBQFUt82d4VW/+2d4dLV5JfYebvqBvJ:1+YYfYebvZg8CYaiDJfYebvk
MD5:	258F1E0D6D21828A0E826024905B1155
SHA1:	1ECDB64EC23ED8C2E4D970C924E986E973EB3C33
SHA-256:	2524607227759EC41E521E9BE4FA8D7BB0A1D9EC79D1A160AFCB06D0727ECD34
SHA-512:	F0339139809C42181754FEAF1478C23A6327C27E85359E629E1AABA317FB5349A25931143D11283FF5FA9768BF791656C00ACE1D5724E0933CB5345BE131FD37
Malicious:	false
Preview:	2024/09/06-12:04:17.251 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/06-12:04:17.252 20ec Recovering log #3.2024/09/06-12:04:17.255 20ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\10aeb920-e228-413d-acd9-48592afca1d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7d761d8d-fbeb-4781-b990-437338f05447.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF4003b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2e7c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\abd30701-cf4f-44d4-9972-29b8ee2ff96c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\dc438e35-7eb4-4178-8adc-1744dce4fb3e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.21967562430381
Encrypted:	false
SSDEEP:	12:PPIjL+vYfYebvqBZFUt82QXW/+2RLV5JfYebvqBaJ:nEYYfYebvyg85iDJfYebvL
MD5:	03F5313430D97B0448BE1A252C53B7E9
SHA1:	502D303051AF8A26CDD2F7F7EDCF6460A04D1F9D
SHA-256:	7B829FB8B8FCC60028558BDA6CC47AF88B69361CE55DBF8AEEC67ADF859BB751
SHA-512:	CC5F0DCAAD9A78232AE15D2274CFAFF7A767775A1035D7F719E02B4FF6A7EB119478844B680019EFC69E63A1F2965435693039A5CF891E9C90157D357DC9896F
Malicious:	false
Preview:	2024/09/06-12:04:32.689 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/06-12:04:32.709 20ec Recovering log #3.2024/09/06-12:04:32.721 20ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.21967562430381
Encrypted:	false
SSDEEP:	12:PPIjL+vYfYebvqBZFUt82QXW/+2RLV5JfYebvqBaJ:nEYYfYebvyg85iDJfYebvL
MD5:	03F5313430D97B0448BE1A252C53B7E9
SHA1:	502D303051AF8A26CDD2F7F7EDCF6460A04D1F9D
SHA-256:	7B829FB8B8FCC60028558BDA6CC47AF88B69361CE55DBF8AEEC67ADF859BB751
SHA-512:	CC5F0DCAAD9A78232AE15D2274CFAFF7A767775A1035D7F719E02B4FF6A7EB119478844B680019EFC69E63A1F2965435693039A5CF891E9C90157D357DC9896F
Malicious:	false
Preview:	2024/09/06-12:04:32.689 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/06-12:04:32.709 20ec Recovering log #3.2024/09/06-12:04:32.721 20ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.15845535820232
Encrypted:	false
SSDEEP:	6:PkUBkCOq2Pwkn23oH+TcwtpIFUt82kUBkCXZmw+2kUgpkwOwkn23oH+Tcwta/WLJ:PdBtOvYfYebmFUt82dBtX/+2dgp5JfYM
MD5:	ED2D7393324A282956ACC56DC665884F
SHA1:	7D468394CFE92D97353731210941BD77B1121476
SHA-256:	B7FBC3461C87DC653D5EA3A8C76EA41CAA5842BCB22484E7505806FC40B7DEE0
SHA-512:	D0EBF6128CBD62089CC98DFBB0D07EB1E97E207B0B8BD2466B0F8D17DF3993F8C44472A7C41914708EDF954F2DD1F0E8C38A30EA327D9A13C26E9E63AACA2E93
Malicious:	false
Preview:	2024/09/06-12:04:16.242 23c0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/06-12:04:16.242 23c0 Recovering log #3.2024/09/06-12:04:16.243 23c0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.15845535820232
Encrypted:	false
SSDEEP:	6:PkUBkCOq2Pwkn23oH+TcwtpIFUt82kUBkCXZmw+2kUgpkwOwkn23oH+Tcwta/WLJ:PdBtOvYfYebmFUt82dBtX/+2dgp5JfYM
MD5:	ED2D7393324A282956ACC56DC665884F
SHA1:	7D468394CFE92D97353731210941BD77B1121476
SHA-256:	B7FBC3461C87DC653D5EA3A8C76EA41CAA5842BCB22484E7505806FC40B7DEE0
SHA-512:	D0EBF6128CBD62089CC98DFBB0D07EB1E97E207B0B8BD2466B0F8D17DF3993F8C44472A7C41914708EDF954F2DD1F0E8C38A30EA327D9A13C26E9E63AACA2E93
Malicious:	false
Preview:	2024/09/06-12:04:16.242 23c0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/06-12:04:16.242 23c0 Recovering log #3.2024/09/06-12:04:16.243 23c0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:3Sa2l/l1lhtlZSO:s3f
MD5:	EA969DD8DC4FAE227E9B55746C89BB86
SHA1:	73E0EED48F8FD7BF0AF2348750236F38EF8F4551
SHA-256:	C8214EDB09CFE2F1780720851B9CE81DA4C8DB982A1B798F8712C380CDE39F32
SHA-512:	0EF2A439CCFF378604BE7BFA8435161C2D8E8F36BCFDE2869F8CD9EB2ED9604EF3EB21961C25A3101CCD9FE15512FB02FAB7333F64008E05CEE7CFD4F3510DAD
Malicious:	false
Preview:	..............w....W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a049eb70-d2fb-418a-b5c9-c08fc4607c5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9297
Entropy (8bit):	5.178590662084595
Encrypted:	false
SSDEEP:	96:sV7qlHJ1Wb9207dXzT8dgBxYisY5Th6Cp9/x+6M8muecmAeC8wKe4zvrB2X6gE5F:sV7IJk7dsgBxYisYPpj+FVAWtBFBf
MD5:	6C41AA68FBA71D9B7E668D8D64B8C4DF
SHA1:	DC2D02CFA127FFCF4182D647D448B5D3CE1BF741
SHA-256:	A44C05B6BE5327A4B1CBCCE0B239BFD7D44B5B9A3A6397845F25DC64F95CC768
SHA-512:	BDCF0E064AB9281CA07C9BB8DF575590B18F43E44A89F3481D6CB970FBB1125A4D2DA24678907DC8B19B50B137CAC2BE225F173C20E96ED19B9C4963478F6E2B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370112256461636","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ad1535f9-3abe-4d5e-9992-4970f12c6409.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.055755502766053
Encrypted:	false
SSDEEP:	96:sV7qlHJ1Wb9207dXzTOYisY5Th6Cp9/x+6M8muecmAeCIne4zvrB2X6gE5AtEHb:sV7IJk7d2YisYPpj+FVA+NBFBf
MD5:	571C084D05E00D549F73CD3A5C0955CA
SHA1:	ACA80C7893AA992658306C12D17985E7DBAC2930
SHA-256:	E5A030EF9242D051E9560C34E41B96CDDA9369888CFC98BFFFA8FB634F62E308
SHA-512:	9B6E9B5CE06EB8CF4FA177C28D4E842D8B8637F378348408B919D6667F808632BB5DE35E8679C91492A5B0CC1A61A09A7A448246225E9EF059BB51B4F6B27C69
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13370112256461636","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c9026ce5-1529-45c8-a425-c6abb4b2fd79.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5569679589015895
Encrypted:	false
SSDEEP:	768:YJxNO07pLGLvSjWPA6fjC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOLsz8rwYp3pztF:YJxNO4cvSjWPA6fjCu1jafoz1YLtF
MD5:	9C6F9CD5FAD77D44BAA41AF922B21097
SHA1:	F8873DAB40C430EFC02511338CFDD8BC8E278ED2
SHA-256:	6CA45462B82FB3135F7AA96C0D385EE0FCE9A33899C77DE192A879CF091C04B7
SHA-512:	44A86217574A12F7255860EECB1D0FECA7570EF74096CE4C0D2BD0E49F7D97582B3B24DF50A249C873699AB8F61FE0738508FF0B52E906C920824F86DDA77131
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370112256230014","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370112256230014","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.302491323816412
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQvxljlHll3seGKT9rcQ6xbCYpOtl:/XntM+4l1ll3sedhObCEO
MD5:	982BCD2B3E3F3BE5D8CCA9EB5F091A76
SHA1:	5790EBA08C2589CAB7440EB20994278C9632E747
SHA-256:	67507F4070E4D3418E444C6F66F466B110DA8FF2CA037094F3816F9825132CFE
SHA-512:	8C786A3E48A44001E96E25FF30F5D997C4AA003E56C2259AB8C1A066EB5B3241AFA443C386B29B44FB89B9B9F339D67D8971DF567064F024967D547EABD34E7B
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f...............x...0................39_config..........6.....n ...1u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.220088723659744
Encrypted:	false
SSDEEP:	6:PkUIwD1wkn23oH+Tcwtfrl2KLllkUqIq2Pwkn23oH+TcwtfrK+IFUv:Pd1yfYeb1LndqIvYfYeb23FUv
MD5:	65149A8B98DF5FCD629F6599662833C1
SHA1:	62434EBB8D0670605CBEBABD2A5EE45573CB3F55
SHA-256:	E82931271D668A0550FFEF4412E4511A70DEE733C2C4262592E086CEE7D36F22
SHA-512:	CB4F90FC3312294B9174447EBFF03E00DF153E3F6DA8FDE81CAB64FECCA7336BC32295BA2B17B73F82BC4FD34FCE589182408CF1D246EC91CEFB3C7739540D11
Malicious:	false
Preview:	2024/09/06-12:04:16.525 23e0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/09/06-12:04:16.647 23e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9275169283101077
Encrypted:	false
SSDEEP:	12:G0nYUtTNVrPzl6/5/Xt21tzJ3PEWXZi+5uh/2Rdj0QWQ0:G0nYUtPrPJ6B/XMtzNP9i+4hORdZx0
MD5:	A21ADD072F290BB8025555CE1EF9014C
SHA1:	BC07D222EF610DCE637F72866D14D7560926EB5C
SHA-256:	1D64B6F3EBA3FC479C8A8A34AB1D17D263E71AC35707450E323DA7E482E48195
SHA-512:	164C693EE34EE72E4401DFF69B7E4CFE2BA100E7F3C8D2665B91BFC200011F808FEF9EB878656CE54478EF7F6B814EAD722C4EDC74F7300BA5E1B696F6CA1CCF
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....s/<..................19_........e.................18_......E...................37_.....`0M..................38_......Hf..................39_.......w<.................20_.........................20_..........................19_.....}....................18_......m=.................37_.....uTN..................38_.......h.................39_........I.................21_......j...................21_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.1997072321923
Encrypted:	false
SSDEEP:	6:PkUvFm81wkn23oH+Tcwtfrzs52KLllkUSAq2Pwkn23oH+TcwtfrzAdIFUv:Pdv0fYebs9LndSAvYfYeb9FUv
MD5:	2B971DD208267129B99766F8756FA380
SHA1:	616734B98E58DA280BD23CD98AABBEE2261A5D8C
SHA-256:	369CBEB771A5441CDF4E24F705E9317E77835D891C62FE7469833EB57460CC3F
SHA-512:	68C001EBB7C13810AD6B524FF6267A5FA1CE8D1A82FDF43FD9EE8499B7A5C6B7E037A6AAFDB6A815C1D00EA121646127ADF553082AB4809151C4B8D64007BAEC
Malicious:	false
Preview:	2024/09/06-12:04:16.469 2380 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/09/06-12:04:16.505 2380 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlKlll:Ls3Kt
MD5:	11AD09A6F341CF9707B3E9ED22C63E36
SHA1:	7F5EF1EF29AA251244FC7EA5EF3219ABA6717518
SHA-256:	70532B1A7B80CDB43DAF200E0F2966A9D32BDEC30A017F169FB301B1ABF86A05
SHA-512:	FB6DE67B3707D68F24AFD5CC82A764C22FFC012B8DCC3AE8971DDBFF5F3D7BB2FF0B9A16C8F63EB433321953D696A5534F70D8306429D8106479D90A9D8DCD4E
Malicious:	false
Preview:	............................................./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNltKtll:Ls3te
MD5:	D79DEEFE0F4317066E7D20B608051777
SHA1:	EC1876A166081E0405565C47F8F4D874221D7856
SHA-256:	4C1016E548D9DC6292748BFBFD31C50D65E162F339880925D4CB17BA52790FC3
SHA-512:	A8E54E8D11C4C7223934CB999434FE706FF1D94B2853DE6C2080F2A4A50E3E599F876A1FDEDD379F4D767C574B07341448A026CDF1AC0D7E284768B46B03BDDD
Malicious:	false
Preview:	........................................'F..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793540253197153
Encrypted:	false
SSDEEP:	96:iaqkHfS3Nr3w5ih/cI9URLl8Rotom2/MFVvlwhIe4IbONIeTC6XQS0qGqk+Z4ujW:aka3LeiRUyTho6qRAq1k8SPxVLZ7VTiq
MD5:	9277A90544D7FE63F6349EBD4F480F02
SHA1:	BD2442EA0B6F5E06A64FE8E75C8CE25D2B8F197B
SHA-256:	51066863B0B7541989E2DE6BB07E3F84460B6866A03C747887408BE2E8D1AB9A
SHA-512:	C4D37895AE38A4106D337E4718D7520D4682CA993324163986D9C01C1036228AE130A1B4D663C2BD4262149C7A86E61987C7281B1EFF8AD19B41B9F8E40774A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABOZhKISO6lM7l/VoITuVFnYH6IJitkwxv7kZEok79NTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d613.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793540253197153
Encrypted:	false
SSDEEP:	96:iaqkHfS3Nr3w5ih/cI9URLl8Rotom2/MFVvlwhIe4IbONIeTC6XQS0qGqk+Z4ujW:aka3LeiRUyTho6qRAq1k8SPxVLZ7VTiq
MD5:	9277A90544D7FE63F6349EBD4F480F02
SHA1:	BD2442EA0B6F5E06A64FE8E75C8CE25D2B8F197B
SHA-256:	51066863B0B7541989E2DE6BB07E3F84460B6866A03C747887408BE2E8D1AB9A
SHA-512:	C4D37895AE38A4106D337E4718D7520D4682CA993324163986D9C01C1036228AE130A1B4D663C2BD4262149C7A86E61987C7281B1EFF8AD19B41B9F8E40774A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABOZhKISO6lM7l/VoITuVFnYH6IJitkwxv7kZEok79NTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d641.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793540253197153
Encrypted:	false
SSDEEP:	96:iaqkHfS3Nr3w5ih/cI9URLl8Rotom2/MFVvlwhIe4IbONIeTC6XQS0qGqk+Z4ujW:aka3LeiRUyTho6qRAq1k8SPxVLZ7VTiq
MD5:	9277A90544D7FE63F6349EBD4F480F02
SHA1:	BD2442EA0B6F5E06A64FE8E75C8CE25D2B8F197B
SHA-256:	51066863B0B7541989E2DE6BB07E3F84460B6866A03C747887408BE2E8D1AB9A
SHA-512:	C4D37895AE38A4106D337E4718D7520D4682CA993324163986D9C01C1036228AE130A1B4D663C2BD4262149C7A86E61987C7281B1EFF8AD19B41B9F8E40774A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABOZhKISO6lM7l/VoITuVFnYH6IJitkwxv7kZEok79NTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f581.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793540253197153
Encrypted:	false
SSDEEP:	96:iaqkHfS3Nr3w5ih/cI9URLl8Rotom2/MFVvlwhIe4IbONIeTC6XQS0qGqk+Z4ujW:aka3LeiRUyTho6qRAq1k8SPxVLZ7VTiq
MD5:	9277A90544D7FE63F6349EBD4F480F02
SHA1:	BD2442EA0B6F5E06A64FE8E75C8CE25D2B8F197B
SHA-256:	51066863B0B7541989E2DE6BB07E3F84460B6866A03C747887408BE2E8D1AB9A
SHA-512:	C4D37895AE38A4106D337E4718D7520D4682CA993324163986D9C01C1036228AE130A1B4D663C2BD4262149C7A86E61987C7281B1EFF8AD19B41B9F8E40774A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABOZhKISO6lM7l/VoITuVFnYH6IJitkwxv7kZEok79NTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f5b0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793540253197153
Encrypted:	false
SSDEEP:	96:iaqkHfS3Nr3w5ih/cI9URLl8Rotom2/MFVvlwhIe4IbONIeTC6XQS0qGqk+Z4ujW:aka3LeiRUyTho6qRAq1k8SPxVLZ7VTiq
MD5:	9277A90544D7FE63F6349EBD4F480F02
SHA1:	BD2442EA0B6F5E06A64FE8E75C8CE25D2B8F197B
SHA-256:	51066863B0B7541989E2DE6BB07E3F84460B6866A03C747887408BE2E8D1AB9A
SHA-512:	C4D37895AE38A4106D337E4718D7520D4682CA993324163986D9C01C1036228AE130A1B4D663C2BD4262149C7A86E61987C7281B1EFF8AD19B41B9F8E40774A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABOZhKISO6lM7l/VoITuVFnYH6IJitkwxv7kZEok79NTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f5ef.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793540253197153
Encrypted:	false
SSDEEP:	96:iaqkHfS3Nr3w5ih/cI9URLl8Rotom2/MFVvlwhIe4IbONIeTC6XQS0qGqk+Z4ujW:aka3LeiRUyTho6qRAq1k8SPxVLZ7VTiq
MD5:	9277A90544D7FE63F6349EBD4F480F02
SHA1:	BD2442EA0B6F5E06A64FE8E75C8CE25D2B8F197B
SHA-256:	51066863B0B7541989E2DE6BB07E3F84460B6866A03C747887408BE2E8D1AB9A
SHA-512:	C4D37895AE38A4106D337E4718D7520D4682CA993324163986D9C01C1036228AE130A1B4D663C2BD4262149C7A86E61987C7281B1EFF8AD19B41B9F8E40774A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABOZhKISO6lM7l/VoITuVFnYH6IJitkwxv7kZEok79NTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF31638.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793540253197153
Encrypted:	false
SSDEEP:	96:iaqkHfS3Nr3w5ih/cI9URLl8Rotom2/MFVvlwhIe4IbONIeTC6XQS0qGqk+Z4ujW:aka3LeiRUyTho6qRAq1k8SPxVLZ7VTiq
MD5:	9277A90544D7FE63F6349EBD4F480F02
SHA1:	BD2442EA0B6F5E06A64FE8E75C8CE25D2B8F197B
SHA-256:	51066863B0B7541989E2DE6BB07E3F84460B6866A03C747887408BE2E8D1AB9A
SHA-512:	C4D37895AE38A4106D337E4718D7520D4682CA993324163986D9C01C1036228AE130A1B4D663C2BD4262149C7A86E61987C7281B1EFF8AD19B41B9F8E40774A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABOZhKISO6lM7l/VoITuVFnYH6IJitkwxv7kZEok79NTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3494f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793540253197153
Encrypted:	false
SSDEEP:	96:iaqkHfS3Nr3w5ih/cI9URLl8Rotom2/MFVvlwhIe4IbONIeTC6XQS0qGqk+Z4ujW:aka3LeiRUyTho6qRAq1k8SPxVLZ7VTiq
MD5:	9277A90544D7FE63F6349EBD4F480F02
SHA1:	BD2442EA0B6F5E06A64FE8E75C8CE25D2B8F197B
SHA-256:	51066863B0B7541989E2DE6BB07E3F84460B6866A03C747887408BE2E8D1AB9A
SHA-512:	C4D37895AE38A4106D337E4718D7520D4682CA993324163986D9C01C1036228AE130A1B4D663C2BD4262149C7A86E61987C7281B1EFF8AD19B41B9F8E40774A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABOZhKISO6lM7l/VoITuVFnYH6IJitkwxv7kZEok79NTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3496e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793540253197153
Encrypted:	false
SSDEEP:	96:iaqkHfS3Nr3w5ih/cI9URLl8Rotom2/MFVvlwhIe4IbONIeTC6XQS0qGqk+Z4ujW:aka3LeiRUyTho6qRAq1k8SPxVLZ7VTiq
MD5:	9277A90544D7FE63F6349EBD4F480F02
SHA1:	BD2442EA0B6F5E06A64FE8E75C8CE25D2B8F197B
SHA-256:	51066863B0B7541989E2DE6BB07E3F84460B6866A03C747887408BE2E8D1AB9A
SHA-512:	C4D37895AE38A4106D337E4718D7520D4682CA993324163986D9C01C1036228AE130A1B4D663C2BD4262149C7A86E61987C7281B1EFF8AD19B41B9F8E40774A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABOZhKISO6lM7l/VoITuVFnYH6IJitkwxv7kZEok79NTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bfe6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793540253197153
Encrypted:	false
SSDEEP:	96:iaqkHfS3Nr3w5ih/cI9URLl8Rotom2/MFVvlwhIe4IbONIeTC6XQS0qGqk+Z4ujW:aka3LeiRUyTho6qRAq1k8SPxVLZ7VTiq
MD5:	9277A90544D7FE63F6349EBD4F480F02
SHA1:	BD2442EA0B6F5E06A64FE8E75C8CE25D2B8F197B
SHA-256:	51066863B0B7541989E2DE6BB07E3F84460B6866A03C747887408BE2E8D1AB9A
SHA-512:	C4D37895AE38A4106D337E4718D7520D4682CA993324163986D9C01C1036228AE130A1B4D663C2BD4262149C7A86E61987C7281B1EFF8AD19B41B9F8E40774A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABOZhKISO6lM7l/VoITuVFnYH6IJitkwxv7kZEok79NTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e6f6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793540253197153
Encrypted:	false
SSDEEP:	96:iaqkHfS3Nr3w5ih/cI9URLl8Rotom2/MFVvlwhIe4IbONIeTC6XQS0qGqk+Z4ujW:aka3LeiRUyTho6qRAq1k8SPxVLZ7VTiq
MD5:	9277A90544D7FE63F6349EBD4F480F02
SHA1:	BD2442EA0B6F5E06A64FE8E75C8CE25D2B8F197B
SHA-256:	51066863B0B7541989E2DE6BB07E3F84460B6866A03C747887408BE2E8D1AB9A
SHA-512:	C4D37895AE38A4106D337E4718D7520D4682CA993324163986D9C01C1036228AE130A1B4D663C2BD4262149C7A86E61987C7281B1EFF8AD19B41B9F8E40774A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABOZhKISO6lM7l/VoITuVFnYH6IJitkwxv7kZEok79NTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4367d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793540253197153
Encrypted:	false
SSDEEP:	96:iaqkHfS3Nr3w5ih/cI9URLl8Rotom2/MFVvlwhIe4IbONIeTC6XQS0qGqk+Z4ujW:aka3LeiRUyTho6qRAq1k8SPxVLZ7VTiq
MD5:	9277A90544D7FE63F6349EBD4F480F02
SHA1:	BD2442EA0B6F5E06A64FE8E75C8CE25D2B8F197B
SHA-256:	51066863B0B7541989E2DE6BB07E3F84460B6866A03C747887408BE2E8D1AB9A
SHA-512:	C4D37895AE38A4106D337E4718D7520D4682CA993324163986D9C01C1036228AE130A1B4D663C2BD4262149C7A86E61987C7281B1EFF8AD19B41B9F8E40774A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABOZhKISO6lM7l/VoITuVFnYH6IJitkwxv7kZEok79NTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNl4E9lKl/ll:Ls34EH+X
MD5:	DDBE0F0AF2FC21E03C69BB6BCEF5B410
SHA1:	475B3DC4548D1954A0AFFCEF5EAE350C63748FF2
SHA-256:	8EA34ADBAF267E59B5CE54C0C9FAB9F49D4EB27F8E2BEE438425BD0A7535B6EE
SHA-512:	54467408C22D1B3965616211F827BB4792452C553F0EA269D8F20DCC4665E12F8ACDA28CDF60E0BA6BB90C5EEA0349199792DBC83D94D7EE6928AE74E0B2B19F
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\da53d679-a669-411a-83ed-e7e78e9cc883.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9456
Entropy (8bit):	5.842669195553562
Encrypted:	false
SSDEEP:	192:fsNwa3XeiRUyEBxC/Uyyk3vi96qRAq1k8SPxVLZ7VTiB:fsNwa7WrCDx3K96q3QxVNZTiB
MD5:	10D3725C7356D18E02F65FCE75AF9251
SHA1:	8B2E04F585953CEF750173D6CF1F3582790210CC
SHA-256:	682370579D985C9F699F1E522D658E0D590B28A6FD47106BCAF80DE80855104F
SHA-512:	E8E26AED30767EADDB36BCCC97E43F01B01A0CC737822E1B66C8DC5FD63DB0168DD6B2B3D0C8BCB044829E9D26025E3A9693192E6E36FE9E62C72A256F595BB6
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\db0b8f63-8815-4694-810e-fba7c4ee81d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9440
Entropy (8bit):	5.84139620031919
Encrypted:	false
SSDEEP:	192:fsNwa3XeiRUyEBxC/x1Clk3t96qRAq1k8SPxVLZ7VTiB:fsNwa7WrCLC23t96q3QxVNZTiB
MD5:	0DD7E8783D9FAE5E8C96AC8CEE58EFCE
SHA1:	513A94697BDF3CFB6C79F01242AA91D2C009115E
SHA-256:	9FBC4D4109FD2DBE2B6C32DF44EDF94770475888952D2D6661B0293787BA3FB7
SHA-512:	39637D629492CFAA8CB64AA8F60D137DE301A87FD8F9679B69F3BD5205356B50AB539B96235C0BA832DB5FA62D094390E06CCA108F6FD2C59D175FA75689D3C2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ed9e2cb7-b60f-46c2-a8f6-373cc9690550.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8349
Entropy (8bit):	5.801242081104385
Encrypted:	false
SSDEEP:	192:fsNwa3XeiRUyE+Qhk3v76qRAq1k8SPxVLZ7VTiQ:fsNwa7W/S3j6q3QxVNZTiQ
MD5:	37B953B8BDEE024B629AC25BE29EC902
SHA1:	C248F186F342145B8AFF91A414582BA97D67B4D9
SHA-256:	3F3BB85BAD067C68C921C9A4AA30FB5A4A3DAD47EDB15374880C9F0100355706
SHA-512:	925ACE124FDAE7DECD17498E5DC6350F3A073C14B6946BF2EF4C0D87D2E0852356ACC4667C37BE2BE8FA053C4D40CD8B73ED625E27F3CA3D81828505DE9ED162
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f742316d-7ccd-480f-8f82-3bb2658db5a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793540253197153
Encrypted:	false
SSDEEP:	96:iaqkHfS3Nr3w5ih/cI9URLl8Rotom2/MFVvlwhIe4IbONIeTC6XQS0qGqk+Z4ujW:aka3LeiRUyTho6qRAq1k8SPxVLZ7VTiq
MD5:	9277A90544D7FE63F6349EBD4F480F02
SHA1:	BD2442EA0B6F5E06A64FE8E75C8CE25D2B8F197B
SHA-256:	51066863B0B7541989E2DE6BB07E3F84460B6866A03C747887408BE2E8D1AB9A
SHA-512:	C4D37895AE38A4106D337E4718D7520D4682CA993324163986D9C01C1036228AE130A1B4D663C2BD4262149C7A86E61987C7281B1EFF8AD19B41B9F8E40774A4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACbZDnupB2YQ41eM+ROTNuhEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABOZhKISO6lM7l/VoITuVFnYH6IJitkwxv7kZEok79NTAAAAAA

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8668000862640985
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxyxl9Il8uWiDz0ZkGIiDGd6Qk8LxCtud1rc:mLYciX0ZkGI0GwQk8LQtF
MD5:	FC5F1B8A232693BE5E726A996B7C846A
SHA1:	95056388CE6C925B8BE62D8B2F23062F336FB655
SHA-256:	DC6345C1AD046FD2B59772793320BA26CADFD2555FB97EF94C8BA649DCEFDA92
SHA-512:	704CB22A1A4394B1BD952B0E68BE6B484B99F7A93C9C3EF170D2518B3285059DAB2DC30F536C1020B880B8A8C6C6220A78AA0A0AF0BA2A15A977035CD70DC36B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.K.2.u.x.X.4.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.m.2.Q.5.7.q.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.003431089021842
Encrypted:	false
SSDEEP:	96:aYc88V+/DW1lKCuCpCsYc7VKu8z8GGhOorlKqo0:aI8s/av9pzVigGGhO4
MD5:	408B3D23A8DABD5780F364542D6719C9
SHA1:	CC70FB11502F60F02F85D116854CD7B464BD1FC5
SHA-256:	D79C4729633459C4E3BB830979913564900F9398FFB5137D03621ADB5B40C920
SHA-512:	DF6B5A44F7D9FC3462EB6C4E9544865066D4590C93FC891419F48592121CA150DA0D0043F164280CB9D7977A3ED7F2B33A527AAD56B586F15FD2F202328C0329
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".+.t.D.7.q.3.Y.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.m.2.Q.5.7.q.

C:\Users\user\AppData\Local\Temp\1ede57e8-2b2f-4025-9e4b-0dcf27640a3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\2d9f15e2-09f7-48b2-866a-f91e2b3a5fcb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9de7849a-4523-4ef7-9084-049dde64e45e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.339706078016668
Encrypted:	false
SSDEEP:	12:YFVjIGDJJL0Dkv/LU4LJu56s/LUUeheTL0Dkv/LUkIu56s/C:Yvjhr0B6Ju5qU+eTL0Bru5M
MD5:	FE3B9CAFF7BA880CBAC99AC6328DF05D
SHA1:	E53052EA2ED04FB04F0C08CFE34B6CF8E0028D61
SHA-256:	879ABDD13EB2A7EE5DCD18E37596A20159D313C1A6F64C71485A3C7DFF5D52BC
SHA-512:	DB13BC188F33DAF325706D5864EECBDB96B934EFB0514889E455524831D19706DC13A73B6314F7536C460CDEAB05CC72533D71ECB9EE1D6DA9B7DB2DAE234D8F
Malicious:	false
Preview:	{"logTime": "0906/160404", "correlationVector":"A3299F28817D4B7E9A080C6A401BBACF","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0906/160418", "correlationVector":"hEKW6KMzevElX+/0/ITST9","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0906/160418", "correlationVector":"A0EB47BD6069483BA0D3A34546AEAB3D","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0906/160418", "correlationVector":"r05OsiYe9/ezUJqZgkLJRA","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\f2dcf767-2657-42a0-8953-e355cc22ef65.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\9de7849a-4523-4ef7-9084-049dde64e45e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8972_1763511056\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir8972_792248313\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8972_792248313\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8972_792248313\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8972_792248313\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8972_792248313\f2dcf767-2657-42a0-8953-e355cc22ef65.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5078826622017445
Encrypted:	false
SSDEEP:	48:IE9v1dOrnKsJHrYzBdLXuHJkDpS2AJFdOr/KsJHrYzngdLXuHJk+21:t3upkDJcnIupkz
MD5:	736EEE200A739F815DE8FA5772FE8925
SHA1:	F18A2523DC5DF10389F9CF9BF1AAD7B5BD22804A
SHA-256:	9691F2EE4F21BF023CC1E19E1CD06D741F572A994DBCC70AC1566426E7412B6F
SHA-512:	624B6370D2D059A24DF24FF8370B055788D4605EA0F66B0275648EAEAB0852B0480AD6F83A848FCB195351BBA706BC66C87484FCCB38A1F9E9E0B9DB612FEF0A
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....Nev....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWR`..PROGRA~2.........O.IDWR`....................V.....f..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.&Y................................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.&Y................................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.&Y......u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........$.WU.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OGUBUFOQUQBY40NE2WK1.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.507479916998176
Encrypted:	false
SSDEEP:	48:IEJFdOr/KsJHrYzBdLXuHJkDpS2AJFdOr/KsJHrYzngdLXuHJk+21:93upkDJcnIupkz
MD5:	15DFAB59ADFC26F6A3EA3A76504056C9
SHA1:	0CCF55E8881B174EFD41DEF2B5D445B87883072D
SHA-256:	031CBD28C5991BB840583EADC477C8F5ED42611AE3ADC0B9E0342C1A6BB62736
SHA-512:	6B2DD37ABF3A6B4853029234F3F4F5AFB0530836D5C14A9CB4869190BB21B4E4DB30E346B5B6D100E0641BE5D500BA25E02C391116438D457C24DEEE777FB06F
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....Nev....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....&Y{...PROGRA~2.........O.I&Y{.....................V......z..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.&Y................................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.&Y.............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.&Y................................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.&Y......u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........$.WU.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZD3VN2N4XXRE457PO9GH.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5078826622017445
Encrypted:	false
SSDEEP:	48:IE9v1dOrnKsJHrYzBdLXuHJkDpS2AJFdOr/KsJHrYzngdLXuHJk+21:t3upkDJcnIupkz
MD5:	736EEE200A739F815DE8FA5772FE8925
SHA1:	F18A2523DC5DF10389F9CF9BF1AAD7B5BD22804A
SHA-256:	9691F2EE4F21BF023CC1E19E1CD06D741F572A994DBCC70AC1566426E7412B6F
SHA-512:	624B6370D2D059A24DF24FF8370B055788D4605EA0F66B0275648EAEAB0852B0480AD6F83A848FCB195351BBA706BC66C87484FCCB38A1F9E9E0B9DB612FEF0A
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....Nev....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWR`..PROGRA~2.........O.IDWR`....................V.....f..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.&Y................................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.&Y................................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.&Y......u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........$.WU.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.507479916998176
Encrypted:	false
SSDEEP:	48:IEJFdOr/KsJHrYzBdLXuHJkDpS2AJFdOr/KsJHrYzngdLXuHJk+21:93upkDJcnIupkz
MD5:	15DFAB59ADFC26F6A3EA3A76504056C9
SHA1:	0CCF55E8881B174EFD41DEF2B5D445B87883072D
SHA-256:	031CBD28C5991BB840583EADC477C8F5ED42611AE3ADC0B9E0342C1A6BB62736
SHA-512:	6B2DD37ABF3A6B4853029234F3F4F5AFB0530836D5C14A9CB4869190BB21B4E4DB30E346B5B6D100E0641BE5D500BA25E02C391116438D457C24DEEE777FB06F
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....Nev....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....&Y{...PROGRA~2.........O.I&Y{.....................V......z..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.&Y................................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.&Y.............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.&Y................................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.&Y......u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........$.WU.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.57971977943598
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	207bf66a2668d5c2d78a611f168ad978
SHA1:	3dccd922f5e5b784d3c50277002715659743aa16
SHA256:	29018ab3dabe541af4f7ea06336fdd0436095629c9b72bfeaa70ae80155648e0
SHA512:	bc3d2895142ef82fb80ac9af2cba3bd20d74dd298553ac79ace1979e6a68f671f2a81f9fb004b103318d046aa3734457015c6ab31ec6abfb0dc5ead076f75309
SSDEEP:	12288:mqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTu:mqDEvCTbMWu7rQYlBQcBiT6rprG8asu
TLSH:	62159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66DB25AB [Fri Sep 6 15:54:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FB3B501F1D3h
jmp 00007FB3B501EADFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FB3B501ECBDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FB3B501EC8Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FB3B502187Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FB3B50218C8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FB3B50218B1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	85b04f5ece23915a90248bd948450222	False	0.2869010416666667	data	5.164668268258604	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 6, 2024 18:04:01.368630886 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 6, 2024 18:04:05.422620058 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:05.422646046 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:05.422934055 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:05.423281908 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:05.423291922 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.088644981 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.088682890 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.088886023 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.089813948 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.089827061 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.113264084 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.113627911 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.113651037 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.114799023 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.114888906 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.116242886 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.116336107 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.116452932 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.116458893 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.163899899 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.225070953 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.225106001 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.225116968 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.225150108 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.225176096 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.225195885 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.225208998 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.225219965 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.225258112 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.313257933 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.313293934 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.313355923 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.313369989 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.313402891 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.313417912 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.315156937 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.315175056 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.315254927 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.315262079 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.315321922 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.405374050 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.405391932 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.405441999 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.405464888 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.405481100 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.405509949 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.405517101 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.405530930 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.405559063 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.406254053 CEST	49749	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.406266928 CEST	443	49749	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.478809118 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.478840113 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.478945017 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.479125023 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.479140043 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.479609013 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.479617119 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.479760885 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.479809999 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.479815960 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.479980946 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.480025053 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.480037928 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.480364084 CEST	49754	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.480370998 CEST	443	49754	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.480427027 CEST	49754	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.480724096 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.480736971 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.481030941 CEST	49754	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.481040955 CEST	443	49754	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.532999039 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.533037901 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.533124924 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.534121037 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.534149885 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.765439987 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.765744925 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.765769005 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.766937017 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.767028093 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.767491102 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.767577887 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.767683983 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.812508106 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.820455074 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.820471048 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.867317915 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.879744053 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.879774094 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.879781008 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.879797935 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.879805088 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.879823923 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.879827976 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.879846096 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.879867077 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.879870892 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.879894972 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.879910946 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.881134033 CEST	49750	443	192.168.2.4	13.107.246.64
Sep 6, 2024 18:04:06.881148100 CEST	443	49750	13.107.246.64	192.168.2.4
Sep 6, 2024 18:04:06.940809011 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.941137075 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.941159010 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.941359043 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.941587925 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.941598892 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.941643000 CEST	443	49754	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.941812992 CEST	49754	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.941822052 CEST	443	49754	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.942300081 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.942354918 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.942750931 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.942809105 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.942827940 CEST	443	49754	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.942871094 CEST	49754	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.944127083 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.944190979 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.944504023 CEST	49754	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.944557905 CEST	443	49754	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.944679022 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.944685936 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.944811106 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.944892883 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.945043087 CEST	49754	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.945049047 CEST	443	49754	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.945115089 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.945120096 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:06.951517105 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.951740980 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.951747894 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.952814102 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.952872992 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.953777075 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.953840017 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.953913927 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.992309093 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.992309093 CEST	49754	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.992309093 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:06.998136997 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.998410940 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:06.998425961 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.999469042 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:06.999517918 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:07.000447035 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:07.000498056 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:07.000505924 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:07.000713110 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:07.000719070 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:07.007904053 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:07.007910013 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:07.054796934 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:07.054810047 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:07.056396008 CEST	443	49754	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:07.056471109 CEST	443	49754	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:07.056478024 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:07.056514025 CEST	49754	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:07.056632996 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:07.056655884 CEST	49754	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:07.056679010 CEST	443	49754	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:07.056694031 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:07.057014942 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:07.057018995 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:07.068106890 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:07.068180084 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:07.068258047 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:07.068339109 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:07.068352938 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:07.076729059 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:07.076788902 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:07.076843977 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:07.076934099 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:07.076940060 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:07.117502928 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:07.117582083 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:07.117713928 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:07.118217945 CEST	49755	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:07.118237019 CEST	443	49755	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:07.772681952 CEST	49761	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:07.772728920 CEST	443	49761	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:07.772883892 CEST	49761	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:07.776036024 CEST	49761	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:07.776057959 CEST	443	49761	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:08.438642025 CEST	443	49761	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:08.438719034 CEST	49761	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:08.454855919 CEST	49761	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:08.454874992 CEST	443	49761	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:08.455142021 CEST	443	49761	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:08.500864029 CEST	49761	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:08.617795944 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.617831945 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.617889881 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.618202925 CEST	49763	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.618237019 CEST	443	49763	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.618283987 CEST	49763	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.618503094 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.618519068 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.618822098 CEST	49763	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.618834972 CEST	443	49763	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.677659035 CEST	49761	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:08.720504045 CEST	443	49761	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:08.867607117 CEST	443	49761	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:08.881728888 CEST	49761	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:08.881756067 CEST	443	49761	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:08.881767988 CEST	49761	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:08.881932020 CEST	443	49761	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:08.881968975 CEST	443	49761	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:08.882010937 CEST	49761	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:09.038552999 CEST	49764	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:09.038599968 CEST	443	49764	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:09.038678885 CEST	49764	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:09.039230108 CEST	49764	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:09.039241076 CEST	443	49764	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:09.096947908 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.099581957 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:09.099605083 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.100018024 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.100729942 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:09.100961924 CEST	443	49763	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.100992918 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.101583958 CEST	49763	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:09.101608038 CEST	443	49763	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.101937056 CEST	443	49763	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.103919983 CEST	49763	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:09.103980064 CEST	443	49763	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.143589020 CEST	49763	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:09.143589020 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:09.176178932 CEST	49765	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.176225901 CEST	443	49765	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.176315069 CEST	49766	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.176325083 CEST	443	49766	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.176382065 CEST	49765	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.176382065 CEST	49766	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.176606894 CEST	49765	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.176631927 CEST	443	49765	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.179424047 CEST	49766	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.179456949 CEST	443	49766	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.491116047 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:09.491158962 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:09.491317034 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:09.491554976 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:09.491580009 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:09.653759003 CEST	443	49765	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.655869007 CEST	443	49766	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.664510012 CEST	49766	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.664555073 CEST	443	49766	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.664730072 CEST	49765	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.664738894 CEST	443	49765	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.664990902 CEST	443	49766	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.665113926 CEST	443	49765	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.665143967 CEST	49766	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.665230036 CEST	49765	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.665735960 CEST	443	49766	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.665792942 CEST	49766	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.665848017 CEST	443	49765	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.666013002 CEST	49765	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.667706013 CEST	49766	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.667781115 CEST	443	49766	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.668041945 CEST	49765	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.668112993 CEST	443	49765	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.668224096 CEST	49766	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.668231964 CEST	443	49766	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.668448925 CEST	49765	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.668456078 CEST	443	49765	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.714143038 CEST	49765	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.714143038 CEST	49766	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.718911886 CEST	443	49764	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:09.719089031 CEST	49764	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:09.728912115 CEST	49764	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:09.728930950 CEST	443	49764	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:09.729199886 CEST	443	49764	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:09.734877110 CEST	49764	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:09.780493975 CEST	443	49764	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:09.839673996 CEST	443	49766	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.839771032 CEST	443	49765	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.840761900 CEST	443	49765	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.840790033 CEST	49766	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.840838909 CEST	443	49766	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.840876102 CEST	49765	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.840976000 CEST	443	49766	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.840986013 CEST	49766	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.841061115 CEST	49766	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.842904091 CEST	49765	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:09.842936039 CEST	443	49765	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:09.967740059 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:09.968347073 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:09.968360901 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:09.969495058 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:09.969680071 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:09.970829964 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:09.970925093 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:09.971142054 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:10.015506983 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:10.015536070 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:10.033284903 CEST	443	49764	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:10.033354998 CEST	443	49764	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:10.033435106 CEST	49764	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:10.034323931 CEST	49764	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:10.034323931 CEST	49764	443	192.168.2.4	23.32.185.164
Sep 6, 2024 18:04:10.034344912 CEST	443	49764	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:10.034358978 CEST	443	49764	23.32.185.164	192.168.2.4
Sep 6, 2024 18:04:10.056454897 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:10.066142082 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:10.066191912 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:10.066231966 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:10.066246033 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:10.066260099 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:10.066292048 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:10.066330910 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:10.066349983 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:10.066401958 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:10.066463947 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:10.066463947 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:10.067744017 CEST	49767	443	192.168.2.4	172.217.165.132
Sep 6, 2024 18:04:10.067770004 CEST	443	49767	172.217.165.132	192.168.2.4
Sep 6, 2024 18:04:10.153465986 CEST	49768	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.153507948 CEST	443	49768	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.153635979 CEST	49768	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.154186010 CEST	49769	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.154217958 CEST	443	49769	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.154310942 CEST	49769	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.154637098 CEST	49768	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.154653072 CEST	443	49768	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.154892921 CEST	49769	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.154913902 CEST	443	49769	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.612603903 CEST	443	49768	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.613300085 CEST	49768	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.613329887 CEST	443	49768	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.613799095 CEST	443	49768	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.613853931 CEST	49768	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.614557028 CEST	443	49768	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.614608049 CEST	49768	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.614769936 CEST	49768	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.614844084 CEST	443	49768	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.633690119 CEST	443	49769	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.634042025 CEST	49769	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.634059906 CEST	443	49769	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.634488106 CEST	443	49769	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.634545088 CEST	49769	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.635267019 CEST	443	49769	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.635314941 CEST	49769	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.635595083 CEST	49769	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.635663033 CEST	443	49769	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.664290905 CEST	49768	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.664331913 CEST	443	49768	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.680355072 CEST	49769	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.680380106 CEST	443	49769	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.711586952 CEST	49768	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.727205992 CEST	49769	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:12.698723078 CEST	49672	443	192.168.2.4	173.222.162.32
Sep 6, 2024 18:04:12.698762894 CEST	443	49672	173.222.162.32	192.168.2.4
Sep 6, 2024 18:04:15.092269897 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:15.092324018 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:15.092519045 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:15.093570948 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:15.093585968 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:15.807281971 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:15.807379007 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:15.811958075 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:15.811969042 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:15.812268019 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:15.853506088 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:16.680136919 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:16.720508099 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:16.911962986 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:16.911988974 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:16.911998987 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:16.912009001 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:16.912038088 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:16.912051916 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:16.912082911 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:16.912096024 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:16.912123919 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:16.912708998 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:16.912784100 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:16.912791967 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:16.912802935 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:16.912848949 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:18.351418972 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:18.351448059 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:18.351463079 CEST	49770	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:18.351469040 CEST	443	49770	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:19.337627888 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:19.337668896 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:19.337898970 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:19.338239908 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:19.338252068 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:19.454850912 CEST	49723	80	192.168.2.4	93.184.221.240
Sep 6, 2024 18:04:19.460339069 CEST	80	49723	93.184.221.240	192.168.2.4
Sep 6, 2024 18:04:19.460526943 CEST	49723	80	192.168.2.4	93.184.221.240
Sep 6, 2024 18:04:19.956301928 CEST	49783	443	192.168.2.4	13.107.246.60
Sep 6, 2024 18:04:19.956345081 CEST	443	49783	13.107.246.60	192.168.2.4
Sep 6, 2024 18:04:19.956471920 CEST	49783	443	192.168.2.4	13.107.246.60
Sep 6, 2024 18:04:19.956738949 CEST	49783	443	192.168.2.4	13.107.246.60
Sep 6, 2024 18:04:19.956756115 CEST	443	49783	13.107.246.60	192.168.2.4
Sep 6, 2024 18:04:19.972743034 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:19.973086119 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:19.973104954 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:19.973469019 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:19.973481894 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:19.973536968 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:19.973546028 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:19.973579884 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:19.974145889 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:19.975503922 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:19.975569010 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:19.975713968 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.020505905 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.024245024 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.024266005 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.071114063 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.239006042 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.239048958 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.239284039 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.239306927 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.241872072 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.241946936 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.241962910 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.248239040 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.248291016 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.248303890 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.254513979 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.254555941 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.254565954 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.260899067 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.260952950 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.260962963 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.267133951 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.267178059 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.267189026 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.273412943 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.273462057 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.273473978 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.279721022 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.280836105 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.280848026 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.321114063 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.325576067 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.328535080 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.328558922 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.328573942 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.328588963 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.328632116 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.334703922 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.341169119 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.341188908 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.341214895 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.341228008 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.341269970 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.349318981 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.354338884 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.354376078 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.354420900 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.354434013 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.354468107 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.360584974 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.366331100 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.366379023 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.366384029 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.366394997 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.366429090 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.372551918 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.378518105 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.378568888 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.378614902 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.378628969 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.378670931 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.383977890 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.389478922 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.389525890 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.389538050 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.394917965 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.394953012 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.394973040 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.394983053 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.395021915 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.400404930 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.406229019 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.406267881 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.406275034 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.406286001 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.406398058 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.411458969 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.417330980 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.417392969 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.417402983 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.421341896 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.421367884 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.421382904 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.421394110 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.421587944 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.424591064 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.428236008 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.428282022 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.428317070 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.428327084 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.428359985 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.431896925 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.437422037 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.437458992 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.437500954 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.437511921 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.437550068 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.439599037 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.442998886 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.443037987 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.443068027 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.443078041 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.443114042 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.446557045 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.450151920 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.450182915 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.450198889 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.450207949 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.450253963 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.453721046 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.456954002 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.457045078 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.457053900 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.460576057 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.460644007 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.460654020 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.464152098 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.464190960 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.464226007 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.464236021 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.464273930 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.467430115 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.470331907 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.470362902 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.470375061 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.470386028 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.470441103 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.473839045 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.479841948 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.479875088 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.479887962 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.479897976 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.479954958 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.481590033 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.484963894 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.484989882 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.485022068 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.485033035 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.485068083 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.488246918 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.491791010 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.491882086 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.491894960 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.491904974 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.492166042 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.494995117 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.498239040 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.498274088 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.498287916 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.498297930 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.498337984 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.498342991 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.501372099 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.501470089 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.501481056 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.504154921 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.504204988 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.504442930 CEST	49781	443	192.168.2.4	142.250.185.225
Sep 6, 2024 18:04:20.504462004 CEST	443	49781	142.250.185.225	192.168.2.4
Sep 6, 2024 18:04:20.617023945 CEST	443	49783	13.107.246.60	192.168.2.4
Sep 6, 2024 18:04:20.617347002 CEST	49783	443	192.168.2.4	13.107.246.60
Sep 6, 2024 18:04:20.617369890 CEST	443	49783	13.107.246.60	192.168.2.4
Sep 6, 2024 18:04:20.618393898 CEST	443	49783	13.107.246.60	192.168.2.4
Sep 6, 2024 18:04:20.618453026 CEST	49783	443	192.168.2.4	13.107.246.60
Sep 6, 2024 18:04:20.643865108 CEST	49783	443	192.168.2.4	13.107.246.60
Sep 6, 2024 18:04:20.643987894 CEST	443	49783	13.107.246.60	192.168.2.4
Sep 6, 2024 18:04:20.644083023 CEST	49783	443	192.168.2.4	13.107.246.60
Sep 6, 2024 18:04:20.644098997 CEST	443	49783	13.107.246.60	192.168.2.4
Sep 6, 2024 18:04:20.746468067 CEST	443	49783	13.107.246.60	192.168.2.4
Sep 6, 2024 18:04:20.746510983 CEST	443	49783	13.107.246.60	192.168.2.4
Sep 6, 2024 18:04:20.746535063 CEST	443	49783	13.107.246.60	192.168.2.4
Sep 6, 2024 18:04:20.746557951 CEST	49783	443	192.168.2.4	13.107.246.60
Sep 6, 2024 18:04:20.746593952 CEST	49783	443	192.168.2.4	13.107.246.60
Sep 6, 2024 18:04:20.750547886 CEST	49783	443	192.168.2.4	13.107.246.60
Sep 6, 2024 18:04:20.750561953 CEST	443	49783	13.107.246.60	192.168.2.4
Sep 6, 2024 18:04:22.721683025 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:22.721720934 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:22.721817017 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:22.722234011 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:22.722248077 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:22.722704887 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:22.722712040 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:22.722861052 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:22.723110914 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:22.723119020 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:22.772577047 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:22.772597075 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:22.772702932 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:22.773461103 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:22.773473978 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.174962044 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:23.175559998 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:23.175589085 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:23.176640034 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:23.176704884 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:23.178044081 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:23.178105116 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:23.178436041 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:23.178445101 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:23.198410988 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.198848963 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.198875904 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.199894905 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.200006008 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.201351881 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.201421976 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.201529026 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.201538086 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.227015018 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:23.240746975 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.240967989 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.240992069 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.242037058 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.242091894 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.243119001 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.243216991 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.243290901 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.243297100 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.258292913 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.286225080 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:23.286293030 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:23.286483049 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:23.286592007 CEST	49786	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:23.286612034 CEST	443	49786	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:23.289504051 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.321923018 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.321985006 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.322133064 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.322232008 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.322243929 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.366234064 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.366309881 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.366358995 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.366513968 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:23.366530895 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.997112036 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.997201920 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:23.997292042 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:24.004806042 CEST	443	49763	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:24.004864931 CEST	443	49763	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:24.004934072 CEST	49763	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:37.621495962 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:37.621531963 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:37.621664047 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:37.621670961 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:37.621695995 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:37.621726036 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:37.621881962 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:37.621891022 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:37.621994019 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:37.622001886 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.303268909 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.303809881 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.311440945 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.311469078 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.311866045 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.313616991 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.313683987 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.314922094 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.314937115 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.315412998 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.316158056 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.316338062 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.353557110 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.368649960 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.443036079 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 6, 2024 18:04:38.443082094 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 6, 2024 18:04:38.443201065 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 6, 2024 18:04:38.443470955 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 6, 2024 18:04:38.443483114 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 6, 2024 18:04:38.998687029 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 6, 2024 18:04:38.998980045 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 6, 2024 18:04:38.999000072 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 6, 2024 18:04:39.000118017 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 6, 2024 18:04:39.000247955 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 6, 2024 18:04:39.001518011 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 6, 2024 18:04:39.001578093 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 6, 2024 18:04:39.001785994 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 6, 2024 18:04:39.001796961 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 6, 2024 18:04:39.045739889 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 6, 2024 18:04:39.105413914 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 6, 2024 18:04:39.106235027 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 6, 2024 18:04:39.106249094 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 6, 2024 18:04:39.106266975 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 6, 2024 18:04:39.106340885 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 6, 2024 18:04:39.106338978 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 6, 2024 18:04:39.106338978 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 6, 2024 18:04:39.106432915 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 6, 2024 18:04:39.107283115 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 6, 2024 18:04:39.107302904 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 6, 2024 18:04:39.483150959 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.483196020 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.483280897 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.483448029 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.483486891 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.483561039 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.483688116 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.483706951 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.483930111 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.483946085 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.940880060 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.942302942 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.942337036 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.942691088 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.943377018 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.943444014 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.958679914 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.958915949 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.958945990 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.959233999 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.959700108 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.959757090 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.993561983 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:40.008702040 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:52.994658947 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:52.994782925 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:52.994873047 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:52.995595932 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:52.995661974 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:52.995709896 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:54.850573063 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:54.850646973 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:54.850785017 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:54.866664886 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:54.866733074 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:54.866786957 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:55.029860973 CEST	49796	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:55.029894114 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:55.029964924 CEST	49796	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:55.030360937 CEST	49796	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:55.030370951 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:55.665108919 CEST	49768	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:55.665139914 CEST	443	49768	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:55.696283102 CEST	49769	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:55.696307898 CEST	443	49769	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:55.723793030 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:55.723932028 CEST	49796	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:55.744626045 CEST	49796	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:55.744637966 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:55.744832993 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:55.752975941 CEST	49796	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:55.796500921 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:55.991897106 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:55.991914988 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:55.991936922 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:55.992058039 CEST	49796	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:55.992074013 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:55.992125988 CEST	49796	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:55.993236065 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:55.993273020 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:55.993314028 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:55.993316889 CEST	49796	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:55.993346930 CEST	49796	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:55.993370056 CEST	49796	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:56.000472069 CEST	49796	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:56.000488997 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:04:56.000530005 CEST	49796	443	192.168.2.4	13.85.23.86
Sep 6, 2024 18:04:56.000535011 CEST	443	49796	13.85.23.86	192.168.2.4
Sep 6, 2024 18:05:01.637631893 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:01.637672901 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:01.637758970 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:01.637820005 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:01.637826920 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:01.637872934 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:01.638030052 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:01.638045073 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:01.638138056 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:01.638154030 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.101080894 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.101691008 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.101715088 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.101999044 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.103460073 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.103518009 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.122692108 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.122932911 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.122944117 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.123394012 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.123660088 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.123739004 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.151364088 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.167475939 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:08.026676893 CEST	49724	80	192.168.2.4	93.184.221.240
Sep 6, 2024 18:05:08.033365011 CEST	80	49724	93.184.221.240	192.168.2.4
Sep 6, 2024 18:05:08.033427954 CEST	49724	80	192.168.2.4	93.184.221.240
Sep 6, 2024 18:05:09.010402918 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:09.010425091 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:09.010436058 CEST	49763	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:09.010461092 CEST	443	49763	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:17.013725042 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:17.013802052 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:17.014178991 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:17.027187109 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:17.027247906 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:17.027309895 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:17.183912992 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:17.183953047 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:17.183962107 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:17.183986902 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:37.994827986 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:05:37.994848013 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 6, 2024 18:05:38.010904074 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:05:38.010910988 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 6, 2024 18:05:40.665047884 CEST	49768	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:40.665064096 CEST	443	49768	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:40.697365046 CEST	49769	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:40.697386980 CEST	443	49769	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:54.024406910 CEST	49763	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:54.024409056 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:54.024425030 CEST	443	49763	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:54.024425983 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:02.023979902 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:02.024018049 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:02.039611101 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:02.039623022 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:02.962553978 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:02.962575912 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:02.962591887 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:02.962599039 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:04.001921892 CEST	49802	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.001939058 CEST	443	49802	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.002165079 CEST	49803	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.002191067 CEST	443	49803	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.002202034 CEST	49802	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.002235889 CEST	49803	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.002393007 CEST	49802	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.002407074 CEST	443	49802	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.002512932 CEST	49803	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.002526999 CEST	443	49803	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.465428114 CEST	443	49803	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.465711117 CEST	49803	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.465727091 CEST	443	49803	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.466000080 CEST	443	49803	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.466279984 CEST	49803	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.466336966 CEST	443	49803	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.477551937 CEST	443	49802	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.477741957 CEST	49802	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.477768898 CEST	443	49802	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.478070974 CEST	443	49802	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.478338003 CEST	49802	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.478398085 CEST	443	49802	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.508040905 CEST	49803	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.523719072 CEST	49802	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.568850994 CEST	49804	443	192.168.2.4	23.200.0.42
Sep 6, 2024 18:06:04.568878889 CEST	443	49804	23.200.0.42	192.168.2.4
Sep 6, 2024 18:06:04.568968058 CEST	49804	443	192.168.2.4	23.200.0.42
Sep 6, 2024 18:06:04.569137096 CEST	49804	443	192.168.2.4	23.200.0.42
Sep 6, 2024 18:06:04.569152117 CEST	443	49804	23.200.0.42	192.168.2.4
Sep 6, 2024 18:06:05.039407015 CEST	443	49804	23.200.0.42	192.168.2.4
Sep 6, 2024 18:06:05.039814949 CEST	49804	443	192.168.2.4	23.200.0.42
Sep 6, 2024 18:06:05.039825916 CEST	443	49804	23.200.0.42	192.168.2.4
Sep 6, 2024 18:06:05.040184021 CEST	443	49804	23.200.0.42	192.168.2.4
Sep 6, 2024 18:06:05.040543079 CEST	49804	443	192.168.2.4	23.200.0.42
Sep 6, 2024 18:06:05.040628910 CEST	443	49804	23.200.0.42	192.168.2.4
Sep 6, 2024 18:06:05.040733099 CEST	49804	443	192.168.2.4	23.200.0.42
Sep 6, 2024 18:06:05.084527016 CEST	443	49804	23.200.0.42	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 6, 2024 18:04:02.451798916 CEST	53	53323	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:03.964989901 CEST	51495	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:03.965348959 CEST	59085	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:05.089490891 CEST	53	52160	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:05.122153044 CEST	53	57604	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:06.470133066 CEST	53731	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:06.470289946 CEST	64941	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:06.470566034 CEST	55176	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:06.470681906 CEST	53273	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:06.471126080 CEST	51157	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:06.471390009 CEST	60185	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:06.471764088 CEST	64554	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:06.471972942 CEST	50629	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:06.477190018 CEST	53	64941	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:06.477767944 CEST	53	55176	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:06.478391886 CEST	53	53731	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:06.479190111 CEST	53	51157	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:06.479216099 CEST	53	60185	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:06.479227066 CEST	53	64554	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:06.479377031 CEST	53	53273	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:06.479924917 CEST	53	50629	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:06.525047064 CEST	52486	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:06.525352955 CEST	57886	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:06.531797886 CEST	53	52486	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:06.532502890 CEST	53	57886	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:08.307496071 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.616698027 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.752705097 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.752778053 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.753081083 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.753148079 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.753854990 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.753963947 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.765476942 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.769519091 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.769649029 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.772044897 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.772464991 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.866913080 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.866942883 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.866959095 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.866969109 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.867763042 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.869515896 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.869748116 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:08.881155014 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.881395102 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.881616116 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:08.975074053 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.024724007 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:09.075119972 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:09.075252056 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:09.171163082 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.172422886 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.172841072 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.176179886 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:09.393779993 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:09.393955946 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:09.488675117 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.489413023 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.489893913 CEST	443	59716	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:09.490289927 CEST	59716	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:09.842880964 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.152905941 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.294372082 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.294740915 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.300363064 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.300384998 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.300398111 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.300410032 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.301922083 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.301983118 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.303654909 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.304136992 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.304428101 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.304896116 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.304919004 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.305131912 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.400145054 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.400437117 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.400449038 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.400547981 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.400643110 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.400902033 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.477543116 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.478033066 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.478363991 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.479350090 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.479984045 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.481161118 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:10.481429100 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:10.573225975 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:18.098253965 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:18.098318100 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:18.192564011 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:18.238759995 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:18.308305025 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:18.311441898 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:18.316381931 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:18.350936890 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:18.435169935 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:19.314971924 CEST	58859	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:19.315134048 CEST	61695	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:19.321933985 CEST	53	58859	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:19.345632076 CEST	53	61695	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:19.642539978 CEST	138	138	192.168.2.4	192.168.2.255
Sep 6, 2024 18:04:21.591933966 CEST	53	50928	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:22.714238882 CEST	49296	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:22.714390993 CEST	64375	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:22.714629889 CEST	62967	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:22.714803934 CEST	50959	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:22.721062899 CEST	53	64375	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:22.721093893 CEST	53	49296	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:22.721879005 CEST	53	62967	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:22.721890926 CEST	53	50959	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:22.765075922 CEST	63465	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:22.765213013 CEST	60184	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:04:22.771881104 CEST	53	63465	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:22.771905899 CEST	53	60184	1.1.1.1	192.168.2.4
Sep 6, 2024 18:04:37.621164083 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:37.931435108 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.300544024 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.300560951 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.300571918 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.300584078 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.300595999 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.306977987 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.310964108 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.314371109 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.314371109 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.315772057 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.319041967 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.413284063 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.413418055 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.413428068 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.413445950 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.415411949 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.416233063 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.416338921 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.418015003 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.418641090 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.439757109 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.439992905 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:38.513597012 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:38.542390108 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:39.177092075 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:39.177092075 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:39.273116112 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:39.312509060 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:39.348112106 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:39.350142956 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:39.362190962 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:39.401371002 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:39.480746031 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:39.480880022 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:39.481656075 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:39.482723951 CEST	57411	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.590044022 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:39.590838909 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:39.592333078 CEST	443	56772	162.159.61.3	192.168.2.4
Sep 6, 2024 18:04:39.592647076 CEST	56772	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:04:39.790422916 CEST	57411	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.909792900 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:39.910201073 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:39.940052986 CEST	443	57411	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.940141916 CEST	443	57411	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.940155029 CEST	443	57411	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.940201998 CEST	443	57411	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.940212965 CEST	443	57411	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:39.940578938 CEST	57411	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.942543983 CEST	57411	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.942898989 CEST	57411	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.943052053 CEST	57411	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.943775892 CEST	57411	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:39.943912029 CEST	57411	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:40.005343914 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:40.038475037 CEST	443	57411	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:40.038769007 CEST	443	57411	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:40.038779020 CEST	443	57411	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:40.038786888 CEST	443	57411	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:40.039201975 CEST	57411	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:40.039280891 CEST	57411	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:40.040890932 CEST	443	57411	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:40.042062044 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:40.042649031 CEST	443	57411	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:40.042710066 CEST	443	57411	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:40.043277025 CEST	57411	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:40.082587004 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:40.083058119 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:40.084506989 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:40.118156910 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:40.148678064 CEST	443	57411	172.64.41.3	192.168.2.4
Sep 6, 2024 18:04:40.180263996 CEST	57411	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:04:40.202090025 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:41.981035948 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:41.981723070 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:42.175501108 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:42.212968111 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:42.257093906 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:42.258909941 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:04:42.260973930 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:42.292963982 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:04:42.380110025 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:01.637376070 CEST	64665	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:01.947470903 CEST	64665	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.099390030 CEST	443	64665	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.099626064 CEST	443	64665	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.100667953 CEST	443	64665	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.100702047 CEST	443	64665	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.100770950 CEST	443	64665	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.100999117 CEST	64665	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.101039886 CEST	64665	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.103050947 CEST	64665	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.103166103 CEST	64665	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.103709936 CEST	64665	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.103832960 CEST	64665	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.197643995 CEST	443	64665	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.197731972 CEST	443	64665	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.198127031 CEST	64665	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.200428009 CEST	443	64665	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.200478077 CEST	443	64665	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.200747967 CEST	64665	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.203499079 CEST	443	64665	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.203572035 CEST	443	64665	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.203782082 CEST	64665	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:02.301352024 CEST	443	64665	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:02.337749958 CEST	64665	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:09.995616913 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:09.995668888 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:10.227715015 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:10.665246964 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:10.868658066 CEST	60617	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:11.090821981 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:11.090881109 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:11.091252089 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:11.091367006 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:11.100043058 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:11.100385904 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:11.100480080 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:11.100512028 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:11.100673914 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:11.105695963 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:11.105881929 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:11.108896017 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:11.109046936 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:11.160252094 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:11.160593987 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:11.180161953 CEST	60617	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:11.200043917 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:11.200057983 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:11.207134962 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:11.207464933 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:11.461574078 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:11.492898941 CEST	60617	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:11.806888103 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:12.103013992 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:12.103059053 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:12.103642941 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:12.103677034 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:12.180655956 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:12.444434881 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:12.444539070 CEST	443	60617	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:12.444581032 CEST	443	60617	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:12.446233988 CEST	443	50186	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:12.446692944 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:12.462279081 CEST	53	60223	1.1.1.1	192.168.2.4
Sep 6, 2024 18:05:12.477349043 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:12.479849100 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:12.541268110 CEST	443	50186	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:12.541342974 CEST	443	50186	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:12.541433096 CEST	443	50186	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:12.541441917 CEST	443	50186	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:12.541707993 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:12.541780949 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:12.542931080 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:12.543098927 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:12.543143988 CEST	443	50186	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:12.543154001 CEST	443	50186	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:12.543937922 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:12.544498920 CEST	443	50186	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:12.547064066 CEST	443	60617	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:12.551795959 CEST	443	50186	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:12.552109003 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:12.606066942 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:12.606451988 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:12.637361050 CEST	443	50186	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:12.639445066 CEST	443	50186	172.64.41.3	192.168.2.4
Sep 6, 2024 18:05:12.654100895 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:12.654417038 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:12.656862974 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:12.657031059 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:12.664882898 CEST	50186	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:05:13.634629965 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:13.908529043 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:14.013789892 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:41.699018002 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:41.792932987 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:41.793497086 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:41.793611050 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:41.821393013 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:41.887243032 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:41.887346983 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:41.915318012 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:41.965464115 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:41.965922117 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:41.966209888 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:41.993401051 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:42.085625887 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:43.604721069 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:43.604778051 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:43.698420048 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:43.728179932 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:43.775701046 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:43.776037931 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:05:43.776078939 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:43.807935953 CEST	64587	443	192.168.2.4	142.250.80.46
Sep 6, 2024 18:05:43.897209883 CEST	443	64587	142.250.80.46	192.168.2.4
Sep 6, 2024 18:06:02.963726044 CEST	60761	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:02.963901043 CEST	60761	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:02.964103937 CEST	60761	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:02.964210987 CEST	60761	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:03.371642113 CEST	60761	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:03.680685043 CEST	443	60761	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:03.686408997 CEST	60761	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:03.738121033 CEST	60761	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:03.775511980 CEST	443	60761	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:03.775676966 CEST	443	60761	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:03.775686026 CEST	443	60761	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:03.775695086 CEST	443	60761	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:03.776041985 CEST	60761	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:03.776109934 CEST	60761	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:03.782555103 CEST	443	60761	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:03.815431118 CEST	60761	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:03.871313095 CEST	443	60761	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:03.873034000 CEST	60761	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:03.970170021 CEST	443	60761	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:03.970968008 CEST	443	60761	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:03.971074104 CEST	443	60761	172.64.41.3	192.168.2.4
Sep 6, 2024 18:06:03.971771955 CEST	60761	443	192.168.2.4	172.64.41.3
Sep 6, 2024 18:06:03.993630886 CEST	56617	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:06:03.993777037 CEST	63401	53	192.168.2.4	1.1.1.1
Sep 6, 2024 18:06:04.000422955 CEST	53	63401	1.1.1.1	192.168.2.4
Sep 6, 2024 18:06:04.000925064 CEST	53	56617	1.1.1.1	192.168.2.4
Sep 6, 2024 18:06:04.001692057 CEST	60636	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.305119991 CEST	60636	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.458230019 CEST	443	60636	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.458244085 CEST	443	60636	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.458254099 CEST	443	60636	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.458347082 CEST	443	60636	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.458359003 CEST	443	60636	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.458909035 CEST	60636	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.460808992 CEST	60636	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.460928917 CEST	60636	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.461220026 CEST	60636	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.461304903 CEST	60636	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.563694000 CEST	443	60636	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.563760042 CEST	443	60636	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.564083099 CEST	60636	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.566328049 CEST	443	60636	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.566462040 CEST	443	60636	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.566589117 CEST	60636	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.567965984 CEST	443	60636	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.567975998 CEST	443	60636	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.568269014 CEST	60636	443	192.168.2.4	162.159.61.3
Sep 6, 2024 18:06:04.678090096 CEST	443	60636	162.159.61.3	192.168.2.4
Sep 6, 2024 18:06:04.711393118 CEST	60636	443	192.168.2.4	162.159.61.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 6, 2024 18:04:19.345731974 CEST	192.168.2.4	1.1.1.1	c24a	(Port unreachable)	Destination Unreachable
Sep 6, 2024 18:05:12.444658995 CEST	192.168.2.4	142.250.80.46	3045	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 6, 2024 18:04:03.964989901 CEST	192.168.2.4	1.1.1.1	0xf037	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:03.965348959 CEST	192.168.2.4	1.1.1.1	0x9680	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Sep 6, 2024 18:04:06.470133066 CEST	192.168.2.4	1.1.1.1	0x83db	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.470289946 CEST	192.168.2.4	1.1.1.1	0xd00b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 18:04:06.470566034 CEST	192.168.2.4	1.1.1.1	0x11fe	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.470681906 CEST	192.168.2.4	1.1.1.1	0xc96a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 18:04:06.471126080 CEST	192.168.2.4	1.1.1.1	0x3541	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.471390009 CEST	192.168.2.4	1.1.1.1	0x8776	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 18:04:06.471764088 CEST	192.168.2.4	1.1.1.1	0x72a9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.471972942 CEST	192.168.2.4	1.1.1.1	0x11cd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 18:04:06.525047064 CEST	192.168.2.4	1.1.1.1	0x5ced	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.525352955 CEST	192.168.2.4	1.1.1.1	0x6ac	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 18:04:19.314971924 CEST	192.168.2.4	1.1.1.1	0xfcca	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:19.315134048 CEST	192.168.2.4	1.1.1.1	0xc08d	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Sep 6, 2024 18:04:22.714238882 CEST	192.168.2.4	1.1.1.1	0xe686	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:22.714390993 CEST	192.168.2.4	1.1.1.1	0x5e4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 18:04:22.714629889 CEST	192.168.2.4	1.1.1.1	0x5108	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:22.714803934 CEST	192.168.2.4	1.1.1.1	0xd5bd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 18:04:22.765075922 CEST	192.168.2.4	1.1.1.1	0xa6b9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:22.765213013 CEST	192.168.2.4	1.1.1.1	0xb8cd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 18:06:03.993630886 CEST	192.168.2.4	1.1.1.1	0x6735	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:06:03.993777037 CEST	192.168.2.4	1.1.1.1	0xc9de	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 6, 2024 18:04:03.972675085 CEST	1.1.1.1	192.168.2.4	0xf037	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:03.973754883 CEST	1.1.1.1	192.168.2.4	0x9680	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:05.421858072 CEST	1.1.1.1	192.168.2.4	0xf3cc	No error (0)	shed.dual-low.s-part-0036.t-0009.t-msedge.net	s-part-0036.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:05.421858072 CEST	1.1.1.1	192.168.2.4	0xf3cc	No error (0)	s-part-0036.t-0009.t-msedge.net		13.107.246.64	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.477190018 CEST	1.1.1.1	192.168.2.4	0xd00b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 18:04:06.477767944 CEST	1.1.1.1	192.168.2.4	0x11fe	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.477767944 CEST	1.1.1.1	192.168.2.4	0x11fe	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.478391886 CEST	1.1.1.1	192.168.2.4	0x83db	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.478391886 CEST	1.1.1.1	192.168.2.4	0x83db	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.479190111 CEST	1.1.1.1	192.168.2.4	0x3541	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.479190111 CEST	1.1.1.1	192.168.2.4	0x3541	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.479216099 CEST	1.1.1.1	192.168.2.4	0x8776	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 18:04:06.479227066 CEST	1.1.1.1	192.168.2.4	0x72a9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.479227066 CEST	1.1.1.1	192.168.2.4	0x72a9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.479377031 CEST	1.1.1.1	192.168.2.4	0xc96a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 18:04:06.479924917 CEST	1.1.1.1	192.168.2.4	0x11cd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 18:04:06.531797886 CEST	1.1.1.1	192.168.2.4	0x5ced	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.531797886 CEST	1.1.1.1	192.168.2.4	0x5ced	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:06.532502890 CEST	1.1.1.1	192.168.2.4	0x6ac	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 18:04:19.321933985 CEST	1.1.1.1	192.168.2.4	0xfcca	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:19.321933985 CEST	1.1.1.1	192.168.2.4	0xfcca	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.225	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:19.345632076 CEST	1.1.1.1	192.168.2.4	0xc08d	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:19.954950094 CEST	1.1.1.1	192.168.2.4	0x32d8	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:19.954950094 CEST	1.1.1.1	192.168.2.4	0x32d8	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:20.525091887 CEST	1.1.1.1	192.168.2.4	0x44a4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:20.525369883 CEST	1.1.1.1	192.168.2.4	0xb84c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:20.525369883 CEST	1.1.1.1	192.168.2.4	0xb84c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:21.556278944 CEST	1.1.1.1	192.168.2.4	0xccc8	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:21.556278944 CEST	1.1.1.1	192.168.2.4	0xccc8	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:21.573303938 CEST	1.1.1.1	192.168.2.4	0x449	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:22.721062899 CEST	1.1.1.1	192.168.2.4	0x5e4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 18:04:22.721093893 CEST	1.1.1.1	192.168.2.4	0xe686	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:22.721093893 CEST	1.1.1.1	192.168.2.4	0xe686	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:22.721879005 CEST	1.1.1.1	192.168.2.4	0x5108	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:22.721879005 CEST	1.1.1.1	192.168.2.4	0x5108	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:22.721890926 CEST	1.1.1.1	192.168.2.4	0xd5bd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 18:04:22.771881104 CEST	1.1.1.1	192.168.2.4	0xa6b9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:22.771881104 CEST	1.1.1.1	192.168.2.4	0xa6b9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:22.771905899 CEST	1.1.1.1	192.168.2.4	0xb8cd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 18:04:23.588334084 CEST	1.1.1.1	192.168.2.4	0xb44e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:23.588334084 CEST	1.1.1.1	192.168.2.4	0xb44e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:24.578556061 CEST	1.1.1.1	192.168.2.4	0xb44e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:24.578556061 CEST	1.1.1.1	192.168.2.4	0xb44e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:25.593890905 CEST	1.1.1.1	192.168.2.4	0xb44e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:25.593890905 CEST	1.1.1.1	192.168.2.4	0xb44e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:27.625602007 CEST	1.1.1.1	192.168.2.4	0xb44e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:27.625602007 CEST	1.1.1.1	192.168.2.4	0xb44e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:04:31.676707983 CEST	1.1.1.1	192.168.2.4	0xb44e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 18:04:31.676707983 CEST	1.1.1.1	192.168.2.4	0xb44e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:06:04.000422955 CEST	1.1.1.1	192.168.2.4	0xc9de	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 18:06:04.000925064 CEST	1.1.1.1	192.168.2.4	0x6735	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 18:06:04.000925064 CEST	1.1.1.1	192.168.2.4	0x6735	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

slscr.update.microsoft.com

clients2.googleusercontent.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49749	13.107.246.64	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:06 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 16:04:06 UTC	583	IN	HTTP/1.1 200 OK Date: Fri, 06 Sep 2024 16:04:06 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: ed2d6e16-301e-006f-0748-ffc0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240906T160406Z-165795675766wv96mecap1swx40000000e6000000000cy8c Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-09-06 16:04:06 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-09-06 16:04:06 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-09-06 16:04:06 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-09-06 16:04:06 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-09-06 16:04:06 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49750	13.107.246.64	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:06 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 16:04:06 UTC	552	IN	HTTP/1.1 200 OK Date: Fri, 06 Sep 2024 16:04:06 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Wed, 04 Sep 2024 17:17:44 GMT ETag: 0x8DCCD057D8088C1 x-ms-request-id: f7ce689d-701e-002c-4072-ffea3a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240906T160406Z-16579567576rhxz5kgqdm3tfq00000000e4g00000000q7nb Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-06 16:04:06 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49752	162.159.61.3	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 16:04:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 16:04:07 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 16:04:07 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8befb167e9388ca8-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 16:04:07 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49754	172.64.41.3	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 16:04:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 16:04:07 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 16:04:07 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8befb167cd0e43da-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 16:04:07 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e2 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49751	162.159.61.3	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 16:04:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 16:04:07 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 16:04:07 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8befb167cd1e32ee-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 16:04:07 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0f 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49753	172.64.41.3	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 16:04:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 16:04:07 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 16:04:07 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8befb167ea52440b-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 16:04:07 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0c 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49755	172.64.41.3	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:07 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 16:04:07 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 16:04:07 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 16:04:07 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8befb1682b09c443-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 16:04:07 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f5 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49761	23.32.185.164	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:08 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-06 16:04:08 UTC	465	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=2472 Date: Fri, 06 Sep 2024 16:04:08 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49766	142.250.80.46	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:09 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-06 16:04:09 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 06 Sep 2024 16:04:09 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49765	142.250.80.46	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:09 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-06 16:04:09 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 06 Sep 2024 16:04:09 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49764	23.32.185.164	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:09 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-06 16:04:10 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=25939 Date: Fri, 06 Sep 2024 16:04:09 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-06 16:04:10 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49767	172.217.165.132	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:09 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-06 16:04:10 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 06 Sep 2024 16:00:13 GMT Expires: Sat, 14 Sep 2024 16:00:13 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 237 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-06 16:04:10 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-09-06 16:04:10 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-09-06 16:04:10 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-09-06 16:04:10 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-09-06 16:04:10 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49770	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:16 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zaUmEH16xoFD+E8&MD=BaKEbXEc HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-06 16:04:16 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 87cbab60-cd86-47da-a3c5-98c4995327b2 MS-RequestId: 8be5064b-f20a-442b-a93e-213babf907b3 MS-CV: KfG1vlj/kEmpr64J.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Sep 2024 16:04:15 GMT Connection: close Content-Length: 24490
2024-09-06 16:04:16 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-06 16:04:16 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49781	142.250.185.225	443	736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:19 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 16:04:20 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AD-8ljt_O5XMJoPXlP6Q8KGWegLxpoAv8Lc1GNJdQ3ftIxlOhGAnKSjCUCnfhK-XxvEt00jIhvM X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Thu, 05 Sep 2024 19:26:09 GMT Expires: Fri, 05 Sep 2025 19:26:09 GMT Cache-Control: public, max-age=31536000 Age: 74291 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-06 16:04:20 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-09-06 16:04:20 UTC	1390	IN	Data Raw: cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-09-06 16:04:20 UTC	1390	IN	Data Raw: fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-09-06 16:04:20 UTC	1390	IN	Data Raw: a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-09-06 16:04:20 UTC	1390	IN	Data Raw: f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-09-06 16:04:20 UTC	1390	IN	Data Raw: ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,p
2024-09-06 16:04:20 UTC	1390	IN	Data Raw: 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 Data Ascii: 4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhP
2024-09-06 16:04:20 UTC	1390	IN	Data Raw: 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-09-06 16:04:20 UTC	1390	IN	Data Raw: 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-09-06 16:04:20 UTC	1390	IN	Data Raw: 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f Data Ascii: ^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49783	13.107.246.60	443	736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:20 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 16:04:20 UTC	552	IN	HTTP/1.1 200 OK Date: Fri, 06 Sep 2024 16:04:20 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Wed, 04 Sep 2024 17:17:44 GMT ETag: 0x8DCCD057D8088C1 x-ms-request-id: f7ce689d-701e-002c-4072-ffea3a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240906T160420Z-165795675767hwjqv3v00bvq340000000e7g0000000080r5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-06 16:04:20 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49786	162.159.61.3	443	736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 16:04:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 16:04:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 16:04:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8befb1cd4a802365-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 16:04:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 03 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49787	172.64.41.3	443	736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 16:04:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 16:04:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 16:04:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8befb1cd7a744382-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 16:04:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 00 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49788	172.64.41.3	443	736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:23 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 16:04:23 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 16:04:23 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 16:04:23 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8befb1cdcf8e42bf-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 16:04:23 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f9 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49791	152.195.19.97	443	736	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:39 UTC	612	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726243459&P2=404&P3=2&P4=QwEpe5bNAxRqis2OzLyOwZbb2szEumdt6elz3rYqvtGJFp8KEUK1zYK8sQmRTfjuzuCjgH2LSw0KWC69NW0Nrg%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: r05OsiYe9/ezUJqZgkLJRA Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 16:04:39 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5565210 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Fri, 06 Sep 2024 16:04:39 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-09-06 16:04:39 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49796	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:04:55 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zaUmEH16xoFD+E8&MD=BaKEbXEc HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-06 16:04:55 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: d03f9105-1b23-4376-a665-ef1ccd78312f MS-RequestId: 4cb44a5f-3c60-4bfd-90e7-17c96e7b2762 MS-CV: SWB6XUYaAkmhHQVu.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Sep 2024 16:04:54 GMT Connection: close Content-Length: 30005
2024-09-06 16:04:55 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-06 16:04:55 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49804	23.200.0.42	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 16:06:05 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8

Target ID:	0
Start time:	12:03:59
Start date:	06/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x9e0000
File size:	917'504 bytes
MD5 hash:	207BF66A2668D5C2D78A611F168AD978
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	12:03:59
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:03:59
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2064,i,3517127856426492125,8360373412142169732,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:03:59
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:04:00
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	12:04:04
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7252 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:04:04
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7144 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:04:04
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6c4680000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:04:05
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=2016,i,4020133965267158852,10633187724936184861,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6c4680000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:04:15
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	12:04:16
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1872 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	12:04:16
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4640 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:04:18
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6072 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:8
Imagebase:	0x7ff6c4680000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:04:18
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6072 --field-trial-handle=2076,i,16788821446167993222,6070588671333179223,262144 /prefetch:8
Imagebase:	0x7ff6c4680000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:04:24
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:04:24
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2068,i,15832991764114500608,6720027621333838498,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:04:32
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:04:32
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2024,i,10775744642403109181,5737898232624335056,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:04:45
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:04:46
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2096,i,1751193295412844575,18210641973751138716,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5%
Total number of Nodes:	1396
Total number of Limit Nodes:	38

Executed Functions

Function 009FF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
keyboardthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 009FF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A3F474
IsIconic.USER32(00000000), ref: 00A3F47D
ShowWindow.USER32(00000000,00000009), ref: 00A3F48A
SetForegroundWindow.USER32(00000000), ref: 00A3F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00A3F4AA
GetCurrentThreadId.KERNEL32 ref: 00A3F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00A3F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00A3F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00A3F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00A3F4DE
SetForegroundWindow.USER32(00000000), ref: 00A3F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A3F4F6
keybd_event.USER32(00000012,00000000), ref: 00A3F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A3F50B
keybd_event.USER32(00000012,00000000), ref: 00A3F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A3F519
keybd_event.USER32(00000012,00000000), ref: 00A3F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A3F528
keybd_event.USER32(00000012,00000000), ref: 00A3F52D
SetForegroundWindow.USER32(00000000), ref: 00A3F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00A3F557

Strings

Shell_TrayWnd, xrefs: 00A3F46F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: c7f47a8ff5e1639a42d5e96c9728f976b59fa0866e0755fe83ac589b2d68683f
Instruction ID: 8e57ef2f3caf512417a71a1310b92cdee92cf620d6822841b2774f84803ecd93
Opcode Fuzzy Hash: c7f47a8ff5e1639a42d5e96c9728f976b59fa0866e0755fe83ac589b2d68683f
Instruction Fuzzy Hash: C4316371E90218BFEB20ABF55C4AFBF7E6CEB44B60F104029F604EA1D1C6B15D41AA60

Function 009E42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 009E430D

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

GetCurrentProcess.KERNEL32(?,00A7CB64,00000000,?,?), ref: 009E4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 009E4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 009E4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 009E4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 009E4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 009E447B
GetSystemInfo.KERNEL32(?,?,?), ref: 009E44A0

Strings

GetNativeSystemInfo, xrefs: 009E4460
|O, xrefs: 00A236F8
kernel32.dll, xrefs: 009E444F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 5a391bbf6e0ad1ba7b44c797ee04e90ceba23a122556a2910e71998633f89e37
Instruction ID: 4ba2c82d277056d725193ee423f9e228dd4a5b542961d43f804d5f7dae9ebcbd
Opcode Fuzzy Hash: 5a391bbf6e0ad1ba7b44c797ee04e90ceba23a122556a2910e71998633f89e37
Instruction Fuzzy Hash: 65A1A96291E3D0DFCB92C7EE7CA01997FE46B26300B984AADD0419B773F2254947DB21

Function 009E42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,009E50AA,?,?,00000000,00000000), ref: 009E42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,009E50AA,?,?,00000000,00000000), ref: 009E42C9
LoadResource.KERNEL32(?,00000000,?,?,009E50AA,?,?,00000000,00000000,?,?,?,?,?,?,009E4F20), ref: 00A235BE
SizeofResource.KERNEL32(?,00000000,?,?,009E50AA,?,?,00000000,00000000,?,?,?,?,?,?,009E4F20), ref: 00A235D3
LockResource.KERNEL32(009E50AA,?,?,009E50AA,?,?,00000000,00000000,?,?,?,?,?,?,009E4F20,?), ref: 00A235E6

Strings

SCRIPT, xrefs: 009E42BF

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 6692985a8a6120d4c401ffe2690adab8c24889c731404607c31c47f6db1892c8
Instruction ID: 0c9c8baae1c7783ed8bc4617386b42e3852e11ae06526328f4458d51b3f34521
Opcode Fuzzy Hash: 6692985a8a6120d4c401ffe2690adab8c24889c731404607c31c47f6db1892c8
Instruction Fuzzy Hash: D611CE70200300BFDB229BA6DC48F677BBEEBC5B61F10816DF516D6260DB71DC008660

Function 00A22BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 009E2B6B

Part of subcall function 009E3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00AB1418,?,009E2E7F,?,?,?,00000000), ref: 009E3A78

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00AA2224), ref: 00A22C10
ShellExecuteW.SHELL32(00000000,?,?,00AA2224), ref: 00A22C17

Strings

runas, xrefs: 00A22C0B

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 8f90244fa8a44219d6346e9c25eccb33f8fcf79fbcc4675f5a63b5b427dc7f1b
Instruction ID: cbdaf2c6e96ae7452509bdcc799909ff10937c9b48d19fb893079b093df28ac4
Opcode Fuzzy Hash: 8f90244fa8a44219d6346e9c25eccb33f8fcf79fbcc4675f5a63b5b427dc7f1b
Instruction Fuzzy Hash: F311D6311083C16AC716FF76DC55FAE77A8ABD2350F98582DF086570A3DF218E4A8712

Function 00A4DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00A25222), ref: 00A4DBCE
GetFileAttributesW.KERNELBASE(?), ref: 00A4DBDD
FindFirstFileW.KERNEL32(?,?), ref: 00A4DBEE
FindClose.KERNEL32(00000000), ref: 00A4DBFA

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 3e61d1e2325cd97dadde50f9f3489ae1d7b3727083f211666fa064513deabae8
Instruction ID: 5e381eb774ff355e2cf2c881ca6776960ede401b7112bb76961b4d1a160dabcd
Opcode Fuzzy Hash: 3e61d1e2325cd97dadde50f9f3489ae1d7b3727083f211666fa064513deabae8
Instruction Fuzzy Hash: 05F0A03081091067C221ABF8AC4D8AA376C9F82334B50871AF83AC20E1EBB059D686D5

Function 00A6AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00A6B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A6B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A6B1D4
_wcslen.LIBCMT ref: 00A6B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A6B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A6B236
_wcslen.LIBCMT ref: 00A6B332

Part of subcall function 00A505A7: GetStdHandle.KERNEL32(000000F6), ref: 00A505C6

_wcslen.LIBCMT ref: 00A6B34B
_wcslen.LIBCMT ref: 00A6B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A6B3B6
GetLastError.KERNEL32(00000000), ref: 00A6B407
CloseHandle.KERNEL32(?), ref: 00A6B439
CloseHandle.KERNEL32(00000000), ref: 00A6B44A
CloseHandle.KERNEL32(00000000), ref: 00A6B45C
CloseHandle.KERNEL32(00000000), ref: 00A6B46E
CloseHandle.KERNEL32(?), ref: 00A6B4E3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 26c6b8dbb6f941ef33e56792a8223cbac011588c336d0c765f317d63bad96940
Instruction ID: 09cf84b56dc9e0eb174a9c489e753de303ab88302e99e257165c611e23e871fb
Opcode Fuzzy Hash: 26c6b8dbb6f941ef33e56792a8223cbac011588c336d0c765f317d63bad96940
Instruction Fuzzy Hash: 85F1AB316183409FC715EF24C891B6EBBF4AF85714F14895DF9998B2A2DB30EC85CB62

Function 009ED730 Relevance: 21.6, APIs: 14, Instructions: 619windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 009ED807
timeGetTime.WINMM ref: 009EDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009EDB28
TranslateMessage.USER32(?), ref: 009EDB7B
DispatchMessageW.USER32(?), ref: 009EDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009EDB9F
Sleep.KERNELBASE(0000000A), ref: 009EDBB1

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 55507b07fa59bff9d43b11ab39b96439e6eea5c2dc1f2d58eb25366db22ed1f9
Instruction ID: f07b4f4cd6cd00735971b07270d0c9bf9ef7dceada31a5683554aed50902d609
Opcode Fuzzy Hash: 55507b07fa59bff9d43b11ab39b96439e6eea5c2dc1f2d58eb25366db22ed1f9
Instruction Fuzzy Hash: 7842F430609381DFD72ACF25C894B6AB7E4BF85314F148A2DF5958B2A2D774EC45CB82

Function 009E2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009E2D07
RegisterClassExW.USER32(00000030), ref: 009E2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009E2D42
InitCommonControlsEx.COMCTL32(?), ref: 009E2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009E2D6F
LoadIconW.USER32(000000A9), ref: 009E2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009E2D94

Strings

0, xrefs: 009E2CE9
TaskbarCreated, xrefs: 009E2D37
AutoIt v3 GUI, xrefs: 009E2D23
+, xrefs: 009E2CF0

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 041ef7509f5b40fa38c9e30e24c6e2103eab54767851e61725dd5f9e6d2d99d3
Instruction ID: d8dbdb519124bfb92187e2fafd8ce8ed10ee3b355feb7492c7247bf2797f2568
Opcode Fuzzy Hash: 041ef7509f5b40fa38c9e30e24c6e2103eab54767851e61725dd5f9e6d2d99d3
Instruction Fuzzy Hash: 7221F2B1901348AFDB00DFE4EC99BDDBBB8FB08715F10821AF615A62A0D7B10586CF91

Function 00A2065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A2039A: CreateFileW.KERNELBASE(00000000,00000000,?,00A20704,?,?,00000000,?,00A20704,00000000,0000000C), ref: 00A203B7

GetLastError.KERNEL32 ref: 00A2076F
__dosmaperr.LIBCMT ref: 00A20776
GetFileType.KERNELBASE(00000000), ref: 00A20782
GetLastError.KERNEL32 ref: 00A2078C
__dosmaperr.LIBCMT ref: 00A20795
CloseHandle.KERNEL32(00000000), ref: 00A207B5
CloseHandle.KERNEL32(?), ref: 00A208FF
GetLastError.KERNEL32 ref: 00A20931
__dosmaperr.LIBCMT ref: 00A20938

Strings

H, xrefs: 00A208BD

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 2786c48f808baa1674cc52c0a6491e4f18e58a1649e2bb24be26f615c52889d2
Instruction ID: 05abe3a3c9d71252a665c31ca7acdfad296daaf07e4a6187e49d8293a3ad78a8
Opcode Fuzzy Hash: 2786c48f808baa1674cc52c0a6491e4f18e58a1649e2bb24be26f615c52889d2
Instruction Fuzzy Hash: 5FA1F432A001188FDF19EF7CED51BAE7BA0AB46320F144169F815AF2E2D7359953CB91

Function 009E344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009E3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00AB1418,?,009E2E7F,?,?,?,00000000), ref: 009E3A78

Part of subcall function 009E3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 009E3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 009E356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00A2318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00A231CE
RegCloseKey.ADVAPI32(?), ref: 00A23210
_wcslen.LIBCMT ref: 00A23277
_wcslen.LIBCMT ref: 00A23286

Strings

\, xrefs: 00A2328C
Software\AutoIt v3\AutoIt, xrefs: 009E3560
Include, xrefs: 00A23184, 00A231C5
\Include\, xrefs: 009E3527

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 8b67481ce0070feb8f0dd888e943aa8a5e63631bfb223b82082f8a7ea36eca62
Instruction ID: 999dd60e452d785d65004e32d9d2d8026dd892099db9a572cfd94722037309d1
Opcode Fuzzy Hash: 8b67481ce0070feb8f0dd888e943aa8a5e63631bfb223b82082f8a7ea36eca62
Instruction Fuzzy Hash: 5D71B3714043409EC715EFA9EC81AABB7E8FF95740F404A2EF5458B1B1EB349A49CB51

Function 009E2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009E2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 009E2B9D
LoadIconW.USER32(00000063), ref: 009E2BB3
LoadIconW.USER32(000000A4), ref: 009E2BC5
LoadIconW.USER32(000000A2), ref: 009E2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009E2BEF
RegisterClassExW.USER32(?), ref: 009E2C40

Part of subcall function 009E2CD4: GetSysColorBrush.USER32(0000000F), ref: 009E2D07
Part of subcall function 009E2CD4: RegisterClassExW.USER32(00000030), ref: 009E2D31
Part of subcall function 009E2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009E2D42
Part of subcall function 009E2CD4: InitCommonControlsEx.COMCTL32(?), ref: 009E2D5F
Part of subcall function 009E2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009E2D6F
Part of subcall function 009E2CD4: LoadIconW.USER32(000000A9), ref: 009E2D85
Part of subcall function 009E2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009E2D94

Strings

#, xrefs: 009E2C16
AutoIt v3, xrefs: 009E2C2F
0, xrefs: 009E2C0F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 55df341e3f934dc92e48610380a45e8a20bfd1f28e2ee557b522740c36722793
Instruction ID: d46361fa1b309db34b2ee3f25c74d332cd6658c3408d76e6b5d2176c3a4e20d1
Opcode Fuzzy Hash: 55df341e3f934dc92e48610380a45e8a20bfd1f28e2ee557b522740c36722793
Instruction Fuzzy Hash: FA216A71E00314ABCB50DFE6EC69BA97FF8FB08B50F50411AE504AA6B1E7B10542CF90

Function 009E3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,009E316A,?,?), ref: 009E31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,009E316A,?,?), ref: 009E3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009E3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,009E316A,?,?), ref: 009E3232
CreatePopupMenu.USER32 ref: 009E3246
PostQuitMessage.USER32(00000000), ref: 009E3267

Strings

TaskbarCreated, xrefs: 009E322D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 1d1e82722d661a8dba45bfc0e344f6286fa50790ccc9054c0d1e346e72c3611a
Instruction ID: c70a2c932a98eeb55f0622ced5f547d7120cf3e7c53697e7865f6688781fd474
Opcode Fuzzy Hash: 1d1e82722d661a8dba45bfc0e344f6286fa50790ccc9054c0d1e346e72c3611a
Instruction Fuzzy Hash: 5041BC34208280B7DF1A9BB9DC1DBB93A5CE741340F84C62DF656872B2EB74CE419761

Function 009E2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 009E2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 009E2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,009E1CAD,?), ref: 009E2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,009E1CAD,?), ref: 009E2CCF

Strings

edit, xrefs: 009E2CAC
AutoIt v3, xrefs: 009E2C89, 009E2C8E, 009E2C8F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 9cb02ecc92e97e66fc85147e600adc775cda381e87607104183d4b4d3f2bdec9
Instruction ID: 6ffb30a5654637841e85cd129985eab3c05268959907522fd51194d06d04e737
Opcode Fuzzy Hash: 9cb02ecc92e97e66fc85147e600adc775cda381e87607104183d4b4d3f2bdec9
Instruction Fuzzy Hash: 5FF030755402907AE77087636C1CE772EBDD7C6F60B54411DF904965B1E6610842DB74

Function 00A4E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00A4E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00A4E9A5
Sleep.KERNEL32(00000000), ref: 00A4E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00A4E9B7
Sleep.KERNELBASE ref: 00A4E9F3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 6c607e12bf2f874b0a776135b31cb9c6fd2305357cfddcbdda1e12485c8613be
Instruction ID: 0d198940efca191b60638ec13724ec9e3e4fffd87b806e3561bd1e4f4d6154a4
Opcode Fuzzy Hash: 6c607e12bf2f874b0a776135b31cb9c6fd2305357cfddcbdda1e12485c8613be
Instruction Fuzzy Hash: 53015735C01629DBCF00EFE5EC49AEDFB78BB48320F40465AE506B2282CB309591CBA1

Function 009E3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,009E3B0F,SwapMouseButtons,00000004,?), ref: 009E3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,009E3B0F,SwapMouseButtons,00000004,?), ref: 009E3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,009E3B0F,SwapMouseButtons,00000004,?), ref: 009E3B83

Strings

Control Panel\Mouse, xrefs: 009E3B3E

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: b356ea282c0499f06d2a6ec6ab7e36c2f3c87c9f3e1d207194328cef41605a69
Instruction ID: f6f6896993532343d1a301369a7cc5ebe24707c343eb1094c11a23bfa35c3849
Opcode Fuzzy Hash: b356ea282c0499f06d2a6ec6ab7e36c2f3c87c9f3e1d207194328cef41605a69
Instruction Fuzzy Hash: 6F112AB5510248FFDB21CFA6DC48ABEB7BCEF44754B148959E806D7110E2319E419BA0

Function 009E3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00A233A2

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 009E3A04

Strings

Line: , xrefs: 00A233EB

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 17dfc8251b4f7bb89faac405f6afd0acea6d28a332bf46fb9d51f7a54889478e
Instruction ID: 52f23219f55c57a1d667f2c78dacd36eb1ac29a7fb45f4715027c92b87b949b7
Opcode Fuzzy Hash: 17dfc8251b4f7bb89faac405f6afd0acea6d28a332bf46fb9d51f7a54889478e
Instruction Fuzzy Hash: 8331F871408380AAC722EB61DC49BDB77DCAF80710F50892EF599871D2EB749E45C7C2

Function 009FFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00A00668

Part of subcall function 00A032A4: RaiseException.KERNEL32(?,?,?,00A0068A,?,00AB1444,?,?,?,?,?,?,00A0068A,009E1129,00AA8738,009E1129), ref: 00A03304

__CxxThrowException@8.LIBVCRUNTIME ref: 00A00685

Strings

Unknown exception, xrefs: 00A00692

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 7890e003a548a99bea3210a14c5f33cb1633d26dfeea0194667ff087059b69c8
Instruction ID: 825a7aad226130db1c60a045e9a0e0d09d6e84a975a507009374a3e9b64357ff
Opcode Fuzzy Hash: 7890e003a548a99bea3210a14c5f33cb1633d26dfeea0194667ff087059b69c8
Instruction Fuzzy Hash: 7DF0C23490020D7BCF00B664FD56EAE776D6E00350F608531B914D65D2EFB2EA25C680

Function 009E10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 009E1BF4
Part of subcall function 009E1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 009E1BFC
Part of subcall function 009E1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 009E1C07
Part of subcall function 009E1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 009E1C12
Part of subcall function 009E1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 009E1C1A
Part of subcall function 009E1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 009E1C22

Part of subcall function 009E1B4A: RegisterWindowMessageW.USER32(00000004,?,009E12C4), ref: 009E1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 009E136A
OleInitialize.OLE32 ref: 009E1388
CloseHandle.KERNEL32(00000000,00000000), ref: 00A224AB

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: b5a8618f8db7c4fd96a06c7842c325f086073d1a5f52db6bfd31aec83257db8a
Instruction ID: 8324b12f36f3009394dcd59495d50bd9bb25edee482ac0b5718e755cb406df1d
Opcode Fuzzy Hash: b5a8618f8db7c4fd96a06c7842c325f086073d1a5f52db6bfd31aec83257db8a
Instruction Fuzzy Hash: A7718AB49112408EC3A5DFFAAD756953BE4FB883947E4832E950AC7273EB3058428F95

Function 00A4C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 009E3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00A4C259
KillTimer.USER32(?,00000001,?,?), ref: 00A4C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00A4C270

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 9ba2abd96b8ef5ebc2ccaece60f44c2811c8b2b3f8946eeb93a13f599e906040
Instruction ID: b090ea81d8a733a00e101867b61372bc0aec770dbf0c1f20076b193e78b49e7c
Opcode Fuzzy Hash: 9ba2abd96b8ef5ebc2ccaece60f44c2811c8b2b3f8946eeb93a13f599e906040
Instruction Fuzzy Hash: 1D310574905344AFEB62DF648855BE7BBFCAB42318F00009ED2DEA7241C7B01A85CB51

Function 00A186AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00A185CC,?,00AA8CC8,0000000C), ref: 00A18704
GetLastError.KERNEL32(?,00A185CC,?,00AA8CC8,0000000C), ref: 00A1870E
__dosmaperr.LIBCMT ref: 00A18739

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: b037801a49018550d4f10871881d754f99b8f218460fc180c21c189326dbb660
Instruction ID: 6e34e85061f3f98ad83f788f05e0479ac53d2609a61981b4907274f147d2bcd0
Opcode Fuzzy Hash: b037801a49018550d4f10871881d754f99b8f218460fc180c21c189326dbb660
Instruction Fuzzy Hash: 7B014E32A0562056D664A374AD55BFE67594BC27B4F39021EF8389F1D3DEA8CCC29150

Function 009EDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 009EDB7B
DispatchMessageW.USER32(?), ref: 009EDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009EDB9F
Sleep.KERNELBASE(0000000A), ref: 009EDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00A31CC9

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 32ddf1675a20318c88e4b74631f75018fb39ba781a815ec6bc38e0dfc50e274a
Instruction ID: 2b308e5155c59cd6c6762ad742274b74d6a7847b6cd637fd4a5467bdcbfd3051
Opcode Fuzzy Hash: 32ddf1675a20318c88e4b74631f75018fb39ba781a815ec6bc38e0dfc50e274a
Instruction Fuzzy Hash: 1EF0FE306453849BE734CBA1DC99FEA73ACEB85311F504A19F65A830D0EB3499898B25

Function 009F1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 009F17F6

Strings

CALL, xrefs: 009F17C6

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: c030787798d8eb1c955b3cd4e8cdb2d243c27e6855fb8fd75bec34b5306f01cb
Instruction ID: e9f42f73cda07ce553d47149333e16d1bc3ad08f0bda67430126b33b812e6dd2
Opcode Fuzzy Hash: c030787798d8eb1c955b3cd4e8cdb2d243c27e6855fb8fd75bec34b5306f01cb
Instruction Fuzzy Hash: F9228970608205EFC714DF14C490B2ABBF5BF89354F24892DF69A8B2A2D775E845CB92

Function 009E2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00A22C8C

Part of subcall function 009E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009E3A97,?,?,009E2E7F,?,?,?,00000000), ref: 009E3AC2

Part of subcall function 009E2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009E2DC4

Strings

X, xrefs: 00A22C5A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 37275d7b8462b439ef190509df82e35373cf0f8cb2d574ac7cb87ae5d1e0aa1c
Instruction ID: b1e8d953e8334af6493d896270feecb9afdeadf6f090143decfd2f0051d693d0
Opcode Fuzzy Hash: 37275d7b8462b439ef190509df82e35373cf0f8cb2d574ac7cb87ae5d1e0aa1c
Instruction Fuzzy Hash: AB21EB70E002989FCB02DF95DC45BEE7BFCAF49304F048059E405B7281DBB459898F61

Function 009E3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 009E3908

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 3c435bbb164ec4fd11664bf8d2d1452ee5d427236e5ef5422fadc80b9247b26e
Instruction ID: d1bce6d091228dc4433bfef3c87423b4af38caae2dee785c35700bcf4058ba4f
Opcode Fuzzy Hash: 3c435bbb164ec4fd11664bf8d2d1452ee5d427236e5ef5422fadc80b9247b26e
Instruction Fuzzy Hash: 9431C171504340CFD761DF65D898BA7BBE8FB49308F00092EF69987251E771AE44CB52

Function 009FF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 009FF661

Part of subcall function 009ED730: GetInputState.USER32 ref: 009ED807

Sleep.KERNEL32(00000000), ref: 00A3F2DE

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 80bb077c4b1f81fc3cbba0a50cb2f80eda77e22add4b1170fd1e8d7d2ed06ef0
Instruction ID: 895eb65a2313edc20378140bb5aa6182a8411181e78dd253a38cf4ac8c4a0b35
Opcode Fuzzy Hash: 80bb077c4b1f81fc3cbba0a50cb2f80eda77e22add4b1170fd1e8d7d2ed06ef0
Instruction Fuzzy Hash: 5BF058312402059FD314EBAAD849B6AB7E8AF85760F004029F95AC7260DF60AC40CB90

Function 009EB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 009EBB4E

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: b0d0115719b1172e5e36ecb53e55215a445c2484a21bae8277de712387ec7edd
Instruction ID: 8f1f6e47025e34b1dc160e8267fcdc2a216435b0771135ee99935e3622390de8
Opcode Fuzzy Hash: b0d0115719b1172e5e36ecb53e55215a445c2484a21bae8277de712387ec7edd
Instruction Fuzzy Hash: 9032AD74A00249DFDB25CF55C8A4FBAB7B9EF44304F14815AFA05AB262C778ED41CB91

Function 00A72598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00A72649

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: c4f55819136b3f60ddb86065a8c9fc9eb5e7c8f737f09c75c27ed22ddd23ad1a
Instruction ID: 64b7ec3598b0f04e60ce4c1f92975e35e3577fed0b7d4a3f2d83f4c65f526dd3
Opcode Fuzzy Hash: c4f55819136b3f60ddb86065a8c9fc9eb5e7c8f737f09c75c27ed22ddd23ad1a
Instruction Fuzzy Hash: E521F674200215AFE710DF19CCD0E36B7A9EF44368B24C46DE89A8B392DB71ED41CB90

Function 00A713B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00A71420

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 4b67db6edb43513328611a10b914db703e91751c8cbd9db548ad06b6b16905f0
Instruction ID: 9515e08581e456f77d94b8abbc0b1753dba74316ddc263149b30af7b1549b242
Opcode Fuzzy Hash: 4b67db6edb43513328611a10b914db703e91751c8cbd9db548ad06b6b16905f0
Instruction Fuzzy Hash: F8318070604242AFD714EF29C895B69F7E2FF85324F44C168E8694B292DB71EC41CBD0

Function 009E4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,009E4EDD,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4E9C
Part of subcall function 009E4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009E4EAE
Part of subcall function 009E4E90: FreeLibrary.KERNEL32(00000000,?,?,009E4EDD,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4EFD

Part of subcall function 009E4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A23CDE,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4E62
Part of subcall function 009E4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009E4E74
Part of subcall function 009E4E59: FreeLibrary.KERNEL32(00000000,?,?,00A23CDE,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4E87

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: d136b9b8a4adb3a02798f7abf3aa23c0714eda19d1ac3bf69583ed91d7d87314
Instruction ID: 47809769861c8d1e5f44b4762399c87bcab13c3174ac7984ce966812971da999
Opcode Fuzzy Hash: d136b9b8a4adb3a02798f7abf3aa23c0714eda19d1ac3bf69583ed91d7d87314
Instruction Fuzzy Hash: 1E110632600305AACF16FF66DD02FAD77A5AF80B11F108C2DF542A61C2EE74DE459B50

Function 00A18402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00A18440

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: f87e05ffa6e00efa780b3f7a011e4ebbc2e9d77d95f1a24d6dac26fc0c9f1ca1
Instruction ID: a69acb88ba083f1ae66d3b8c31a89295328a40c732f0d56d3f41ffd7fae5d97f
Opcode Fuzzy Hash: f87e05ffa6e00efa780b3f7a011e4ebbc2e9d77d95f1a24d6dac26fc0c9f1ca1
Instruction Fuzzy Hash: 7511487590410AAFCB05DF58E9409DB7BF9EF48300F104069F808AB312DA30DA11CBA4

Function 00A15000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A14C7D: RtlAllocateHeap.NTDLL(00000008,009E1129,00000000,?,00A12E29,00000001,00000364,?,?,?,00A0F2DE,00A13863,00AB1444,?,009FFDF5,?), ref: 00A14CBE

_free.LIBCMT ref: 00A1506C

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: f8be20e4528107409a7cdb34c87fdc3adce2f63178e036898d53982d7ce007a7
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: DB012672604704AFE3218F69D881ADAFBECFBC9370F25052DE18483280EA30A945C7B4

Function 00A729BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,00A714B5,?), ref: 00A72A01

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: d5fc2d041d99737358d32b56816bda405f6691bc80f2dc355cf11e17bc346206
Instruction ID: 04452b19285cab50cd6f50e6f0f6f59a078b455a16dbc73d6548ad1a37692b9c
Opcode Fuzzy Hash: d5fc2d041d99737358d32b56816bda405f6691bc80f2dc355cf11e17bc346206
Instruction Fuzzy Hash: C6014C36740A419FD3358B2DC854B2677A2EBC5354F69C569D14B8B251DA32EC42C7A0

Function 00A0E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 306f310425b37c189a2fe9f4ec0ea8b7582425718ad46b5b2bd136ffdae7cbaa
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 96F04432500A189AD6317B69BE05B9A33988F52370F100B15F420931C2CB75D84196A5

Function 00A7149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 00A714EB

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8695879fd2a922bd9ef05127a22358862dd6785fb73ed2477d887f372553d1f6
Instruction ID: 62d0f90b47e3d8a2930fd5abd20ca240f87bad7e50c8d4d7ebd827b9ecd65406
Opcode Fuzzy Hash: 8695879fd2a922bd9ef05127a22358862dd6785fb73ed2477d887f372553d1f6
Instruction Fuzzy Hash: 8701BC752046419F9320CFAEC840926BBA5EB84364754C0A9E84E8B702E632DD82CB80

Function 00A14C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,009E1129,00000000,?,00A12E29,00000001,00000364,?,?,?,00A0F2DE,00A13863,00AB1444,?,009FFDF5,?), ref: 00A14CBE

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dc96e1f482a356ddd115b2f1ea89f8ed9a983d5dd80c05376c06f88d0c2f12e6
Instruction ID: b91459568ec8c61e6c746fc7f10e10884e6d7cdcf870489c0b7dfe4c9c449813
Opcode Fuzzy Hash: dc96e1f482a356ddd115b2f1ea89f8ed9a983d5dd80c05376c06f88d0c2f12e6
Instruction Fuzzy Hash: C3F0E93160732467DB215F6EAD09BDA3798BF597F0B144225BC19AA1D1CA30D89186E0

Function 00A13820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00AB1444,?,009FFDF5,?,?,009EA976,00000010,00AB1440,009E13FC,?,009E13C6,?,009E1129), ref: 00A13852

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 36c3d2969b4bbbc0e45e0efa181ea575cea3a2c1a7408e09effba034839457aa
Instruction ID: e385f70d976f1bacf98f36e8470880024e4fd703d1b5a07199915642630bf285
Opcode Fuzzy Hash: 36c3d2969b4bbbc0e45e0efa181ea575cea3a2c1a7408e09effba034839457aa
Instruction Fuzzy Hash: 35E02B33102328A6DF312FB7AD04BDB3758AF427B0F054130BD08968D1DB10DD8181E0

Function 009E4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4F6D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: c5600a38aee687ebd35f3e44feed7d4bd7ed6cb64e212f51464dde9ccbb9e437
Instruction ID: 8d7387b7e812d9f03ec2b867184822fd08addcc81d5646304d909fb8403a724b
Opcode Fuzzy Hash: c5600a38aee687ebd35f3e44feed7d4bd7ed6cb64e212f51464dde9ccbb9e437
Instruction Fuzzy Hash: 2BF03071105791CFDB359F66E494812B7E4AF147293108E7EE1DA83511C735DC44DF50

Function 00A72A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00A72A66

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: a072274cc2ea7d6427b95bdc96dd1e0af2ac542959a727bdaccef801d8f5b275
Instruction ID: ecbb31b6fc401b347270927eff21823fce9818a46ef609d3ef04e35a3d130a8c
Opcode Fuzzy Hash: a072274cc2ea7d6427b95bdc96dd1e0af2ac542959a727bdaccef801d8f5b275
Instruction Fuzzy Hash: 79E04F36350116AAC714EB30EC80AFA735CEF543D5B10D53AAC1AD2100DB30999587A0

Function 009E2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009E2DC4

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 7b925d09111b2b99da6ae0562c715bffc29de99c483e1b01d506c35d46bc3418
Instruction ID: 0940a82833cdae0d3588b3d0855582b03450897427f93910c69d50ebae208013
Opcode Fuzzy Hash: 7b925d09111b2b99da6ae0562c715bffc29de99c483e1b01d506c35d46bc3418
Instruction Fuzzy Hash: 1EE0CD726041246BC711E2989C05FDA77DDDFC87D0F044075FD09D7258D960EDC08590

Function 009E2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009E3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 009E3908

Part of subcall function 009ED730: GetInputState.USER32 ref: 009ED807

SetCurrentDirectoryW.KERNEL32(?), ref: 009E2B6B

Part of subcall function 009E30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 009E314E

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 6de8daec4ce86b998cc009c62428a7477e522301a61cbc31acdf02e155ace6ca
Instruction ID: b4eb9fdab7cf1751a26890dd990e86d14438f13d46f1f8a0bc1d69d78b1b0391
Opcode Fuzzy Hash: 6de8daec4ce86b998cc009c62428a7477e522301a61cbc31acdf02e155ace6ca
Instruction Fuzzy Hash: 8CE026613002C403C606BB72E82A6ADB34D9BD1311F80453EF046831A3CE218D864311

Function 00A43D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00A43D18

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 08046b341b244acf830f1da205cab9d7ca5119bdffb8648d428a77891f10a748
Instruction ID: dfb76d34acf3e0e265b20ad4ab4fc49c735e931a4658189f41e5df039555efa5
Opcode Fuzzy Hash: 08046b341b244acf830f1da205cab9d7ca5119bdffb8648d428a77891f10a748
Instruction Fuzzy Hash: F2D08CF06A03087EFB0083B18C0BEBB339CC316E91F008BA87E02D64C1D9A0DE090130

Function 00A2039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00A20704,?,?,00000000,?,00A20704,00000000,0000000C), ref: 00A203B7

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fd889a55b66bef94c688ce1d16fdb901aaab315483cf1f440f8b4a9acacd0896
Instruction ID: 7cbc23ea14ff399b45113ad0bd5b2892167045e2cec1dd238deeffe012f18502
Opcode Fuzzy Hash: fd889a55b66bef94c688ce1d16fdb901aaab315483cf1f440f8b4a9acacd0896
Instruction Fuzzy Hash: 43D06C3204010DBBDF028F84DD06EDA3BAAFB48714F018150BE1856020C732E862AB90

Function 009E1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 009E1CBC

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: a581189b335480f76d09fce887ba96f0148c717f5e6d972b346d509cd8c84bd0
Instruction ID: 78f0ecbaac307919bc0ef3afbde8fa8de3da2a98c4693c9d69a6f68981de5ff9
Opcode Fuzzy Hash: a581189b335480f76d09fce887ba96f0148c717f5e6d972b346d509cd8c84bd0
Instruction Fuzzy Hash: D0C092362C0304AFF224CBC0BC5EF1077A4A348B14F488202F60DA95F3D3A22862EB50

Non-executed Functions

Function 00A79576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00A7961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A7965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00A7969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A796C9
SendMessageW.USER32 ref: 00A796F2
GetKeyState.USER32(00000011), ref: 00A7978B
GetKeyState.USER32(00000009), ref: 00A79798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A797AE
GetKeyState.USER32(00000010), ref: 00A797B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A797E9
SendMessageW.USER32 ref: 00A79810
SendMessageW.USER32(?,00001030,?,00A77E95), ref: 00A79918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00A7992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00A79941
SetCapture.USER32(?), ref: 00A7994A
ClientToScreen.USER32(?,?), ref: 00A799AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00A799BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A799D6
ReleaseCapture.USER32 ref: 00A799E1
GetCursorPos.USER32(?), ref: 00A79A19
ScreenToClient.USER32(?,?), ref: 00A79A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A79A80
SendMessageW.USER32 ref: 00A79AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A79AEB
SendMessageW.USER32 ref: 00A79B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00A79B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00A79B4A
GetCursorPos.USER32(?), ref: 00A79B68
ScreenToClient.USER32(?,?), ref: 00A79B75
GetParent.USER32(?), ref: 00A79B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A79BFA
SendMessageW.USER32 ref: 00A79C2B
ClientToScreen.USER32(?,?), ref: 00A79C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00A79CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A79CDE
SendMessageW.USER32 ref: 00A79D01
ClientToScreen.USER32(?,?), ref: 00A79D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00A79D82

Part of subcall function 009F9944: GetWindowLongW.USER32(?,000000EB), ref: 009F9952

GetWindowLongW.USER32(?,000000F0), ref: 00A79E05

Strings

@GUI_DRAGID, xrefs: 00A7997D
F, xrefs: 00A79D07

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 5d851710a3c85d5d82156ab46d693c77d5ebbfd727e947f92d47357ebc4c0f1f
Instruction ID: 5af9dd779329d53c7d074c252e4705747d40cb7a3a5243b0e8e3fcfa2a4dfb4b
Opcode Fuzzy Hash: 5d851710a3c85d5d82156ab46d693c77d5ebbfd727e947f92d47357ebc4c0f1f
Instruction Fuzzy Hash: 61427A74204241AFDB25CF68CC94AABBBE5FF89320F14C61EF69D872A1D731A851CB51

Function 00A74873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00A748F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00A74908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00A74927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00A7494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00A7495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00A7497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00A749AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00A749D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00A74A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00A74A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00A74A7E
IsMenu.USER32(?), ref: 00A74A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A74AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A74B20
GetWindowLongW.USER32(?,000000F0), ref: 00A74B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00A74BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00A74C82
wsprintfW.USER32 ref: 00A74CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A74CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00A74CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00A74D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A74D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00A74D5A

Strings

%d/%02d/%02d, xrefs: 00A74CA8

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 8061142dcad077286065e15771af2d558c8cffd60f891735f44da9e152c997eb
Instruction ID: f8f0567910f02d4d876451386b8cbccbfec5ce0df59000b2991f1cd3f027cefd
Opcode Fuzzy Hash: 8061142dcad077286065e15771af2d558c8cffd60f891735f44da9e152c997eb
Instruction Fuzzy Hash: F312A271600258ABEB258F64CC49FAE7BF8EF89710F14C129F51ADB2E1DB789941CB50

Function 00A41201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00A416C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A4170D
Part of subcall function 00A416C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A4173A
Part of subcall function 00A416C3: GetLastError.KERNEL32 ref: 00A4174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00A41286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00A412A8
CloseHandle.KERNEL32(?), ref: 00A412B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00A412D1
GetProcessWindowStation.USER32 ref: 00A412EA
SetProcessWindowStation.USER32(00000000), ref: 00A412F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00A41310

Part of subcall function 00A410BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A411FC), ref: 00A410D4
Part of subcall function 00A410BF: CloseHandle.KERNEL32(?,?,00A411FC), ref: 00A410E9

Strings

winsta0, xrefs: 00A412CC
, xrefs: 00A4125A
default, xrefs: 00A4130B

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 7e756bb38a953d972631ae054720686eaa11882a034e8f44680dab8e01472d2b
Instruction ID: 2ac8c0db3b2ce438de5c00b3e9fccffbef92d47b9f2e3f6ab0a671020579d828
Opcode Fuzzy Hash: 7e756bb38a953d972631ae054720686eaa11882a034e8f44680dab8e01472d2b
Instruction Fuzzy Hash: F981BCB5A00209AFDF21DFA4DD49FEE7BB9EF84704F148129FA15B61A0D7309985CB60

Function 00A40B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A410F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A41114
Part of subcall function 00A410F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A41120
Part of subcall function 00A410F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A4112F
Part of subcall function 00A410F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A41136
Part of subcall function 00A410F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A4114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A40BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A40C00
GetLengthSid.ADVAPI32(?), ref: 00A40C17
GetAce.ADVAPI32(?,00000000,?), ref: 00A40C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A40C6D
GetLengthSid.ADVAPI32(?), ref: 00A40C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00A40C8C
HeapAlloc.KERNEL32(00000000), ref: 00A40C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A40CB4
CopySid.ADVAPI32(00000000), ref: 00A40CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A40CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A40D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A40D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A40D45
HeapFree.KERNEL32(00000000), ref: 00A40D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A40D55
HeapFree.KERNEL32(00000000), ref: 00A40D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A40D65
HeapFree.KERNEL32(00000000), ref: 00A40D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00A40D78
HeapFree.KERNEL32(00000000), ref: 00A40D7F

Part of subcall function 00A41193: GetProcessHeap.KERNEL32(00000008,00A40BB1,?,00000000,?,00A40BB1,?), ref: 00A411A1
Part of subcall function 00A41193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00A40BB1,?), ref: 00A411A8
Part of subcall function 00A41193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00A40BB1,?), ref: 00A411B7

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: cbf47c05ec6054c60f329a4833995cc8c15731b66e73eb3a9af95e749bd9f830
Instruction ID: 2db4d159e8b9c5dfd0d7e3aad76b1adfc2b3f1b042fab046d3673fe921ca38ff
Opcode Fuzzy Hash: cbf47c05ec6054c60f329a4833995cc8c15731b66e73eb3a9af95e749bd9f830
Instruction Fuzzy Hash: 33717075900219EBDF10DFE4DC44FAEBBB8BF44310F048629EA14A6151D771A946DBA0

Function 00A5EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00A7CC08), ref: 00A5EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00A5EB37
GetClipboardData.USER32(0000000D), ref: 00A5EB43
CloseClipboard.USER32 ref: 00A5EB4F
GlobalLock.KERNEL32(00000000), ref: 00A5EB87
CloseClipboard.USER32 ref: 00A5EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00A5EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00A5EBC9
GetClipboardData.USER32(00000001), ref: 00A5EBD1
GlobalLock.KERNEL32(00000000), ref: 00A5EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 00A5EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00A5EC38
GetClipboardData.USER32(0000000F), ref: 00A5EC44
GlobalLock.KERNEL32(00000000), ref: 00A5EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00A5EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00A5EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00A5ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 00A5ECF3
CountClipboardFormats.USER32 ref: 00A5ED14
CloseClipboard.USER32 ref: 00A5ED59

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: e7d06ad3cb4d5b7c8212dae5c2273046e82c9ca4ac84e3221fdc4f33246f855b
Instruction ID: f18f04349cb3d0c714ec949635ec0a8397d3f196b39e13cd67aa2754ed1ca3c8
Opcode Fuzzy Hash: e7d06ad3cb4d5b7c8212dae5c2273046e82c9ca4ac84e3221fdc4f33246f855b
Instruction Fuzzy Hash: FE61E135204241AFD305EF60DC88F6A77B4BF84715F14851DF85A872A2CB30DE8ACBA2

Function 00A5698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A569BE
FindClose.KERNEL32(00000000), ref: 00A56A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A56A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A56A75

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00A56AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A56ADF

Strings

%4d%02d%02d%02d%02d%02d%03d, xrefs: 00A56B32
%4d, xrefs: 00A56BB1
%03d, xrefs: 00A56DA2
%02d, xrefs: 00A56C00, 00A56C0A, 00A56C5A, 00A56CAA, 00A56CFA, 00A56D4A
%4d%02d%02d%02d%02d%02d, xrefs: 00A56B6A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: b514b2f18a17cc171cfc7ebcfad0883c240c9305153aecdea386c5f83285be2b
Instruction ID: 280a7ec8d67cb377596c170a03f3069e1f73be3b538b062a8ee47142aef01186
Opcode Fuzzy Hash: b514b2f18a17cc171cfc7ebcfad0883c240c9305153aecdea386c5f83285be2b
Instruction Fuzzy Hash: FCD16072508340AEC711EBA1D891EABB7ECBF98705F44491DF989C7191EB34DE48CB62

Function 00A59642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00A59663
GetFileAttributesW.KERNEL32(?), ref: 00A596A1
SetFileAttributesW.KERNEL32(?,?), ref: 00A596BB
FindNextFileW.KERNEL32(00000000,?), ref: 00A596D3
FindClose.KERNEL32(00000000), ref: 00A596DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00A596FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00A5974A
SetCurrentDirectoryW.KERNEL32(00AA6B7C), ref: 00A59768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A59772
FindClose.KERNEL32(00000000), ref: 00A5977F
FindClose.KERNEL32(00000000), ref: 00A5978F

Strings

*.*, xrefs: 00A596F5

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 93c3771160563cee1eeb4d341eeafe529c7b10d7bc194e00b374a1c1e0372055
Instruction ID: 6cb2550f6f3eb7a0b04db0d8f0e6a73de3d26b593e8a53797443c50d7bdef71c
Opcode Fuzzy Hash: 93c3771160563cee1eeb4d341eeafe529c7b10d7bc194e00b374a1c1e0372055
Instruction Fuzzy Hash: 8B31C532541619BEDB14EFF4DC48ADF77ACBF09321F14855AF809E6091EB30D9898E60

Function 00A5979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00A597BE
FindNextFileW.KERNEL32(00000000,?), ref: 00A59819
FindClose.KERNEL32(00000000), ref: 00A59824
FindFirstFileW.KERNEL32(*.*,?), ref: 00A59840
SetCurrentDirectoryW.KERNEL32(?), ref: 00A59890
SetCurrentDirectoryW.KERNEL32(00AA6B7C), ref: 00A598AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A598B8
FindClose.KERNEL32(00000000), ref: 00A598C5
FindClose.KERNEL32(00000000), ref: 00A598D5

Part of subcall function 00A4DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00A4DB00

Strings

*.*, xrefs: 00A5983B

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 0fb589e8a49e84ee21babe6295b489e22d911ea4c7df47c8c6e4e606be2105f0
Instruction ID: aea690df28bc0499c4f23a849086d9290e789e556d590e7a5d93ac490beab0b2
Opcode Fuzzy Hash: 0fb589e8a49e84ee21babe6295b489e22d911ea4c7df47c8c6e4e606be2105f0
Instruction Fuzzy Hash: 2331A532541619BADB10EFB4EC48ADF77ACBF0A321F148559E814AB1D1DB30DA898F60

Function 00A6BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A6C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A6B6AE,?,?), ref: 00A6C9B5
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6C9F1
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA68
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A6BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00A6BFA9
RegCloseKey.ADVAPI32(00000000), ref: 00A6BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00A6C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00A6C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00A6C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00A6C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00A6C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00A6C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00A6C382
RegCloseKey.ADVAPI32(00000000), ref: 00A6C38F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 42fa8684a7840bb0dd5cf9ce8e144b074b6617be37c44073742f43395d6430a8
Instruction ID: b44a35a7ef047e0e9f450a745df3979b585929bcfbf805089437800b1f73dddd
Opcode Fuzzy Hash: 42fa8684a7840bb0dd5cf9ce8e144b074b6617be37c44073742f43395d6430a8
Instruction Fuzzy Hash: 8B023C71604240AFD715DF24C895E2ABBF5AF89314F18C49DF88ACB2A2DB31ED46CB51

Function 00A58195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00A58257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A58267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00A58273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A58310
SetCurrentDirectoryW.KERNEL32(?), ref: 00A58324
SetCurrentDirectoryW.KERNEL32(?), ref: 00A58356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00A5838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00A58395

Strings

*.*, xrefs: 00A5839B

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 9eae3f20488b5f2437318da6b74df0d24576c841f510d37e7812f01a13316462
Instruction ID: 6c334b8f22aa878678b5de635d77b87f23b17f44381f8f239927ff8d8b8910a9
Opcode Fuzzy Hash: 9eae3f20488b5f2437318da6b74df0d24576c841f510d37e7812f01a13316462
Instruction Fuzzy Hash: A7617BB25043459FC710EF64C840AAFB3E8FF89320F04892EF99997251DB35E949CB92

Function 00A4D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009E3A97,?,?,009E2E7F,?,?,?,00000000), ref: 009E3AC2

Part of subcall function 00A4E199: GetFileAttributesW.KERNEL32(?,00A4CF95), ref: 00A4E19A

FindFirstFileW.KERNEL32(?,?), ref: 00A4D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00A4D1DD
MoveFileW.KERNEL32(?,?), ref: 00A4D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00A4D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A4D237

Part of subcall function 00A4D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00A4D21C,?,?), ref: 00A4D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00A4D253
FindClose.KERNEL32(00000000), ref: 00A4D264

Strings

\*.*, xrefs: 00A4D0CD, 00A4D0D6, 00A4D0EB

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 23ca6d74f4311f44f0d4f3f0626b3cd05b225e4775ed2f999d78b2313071f154
Instruction ID: 4d820838d458eeec675d618db58d23cfdd061ff4d565a294b1e022e83a7882ee
Opcode Fuzzy Hash: 23ca6d74f4311f44f0d4f3f0626b3cd05b225e4775ed2f999d78b2313071f154
Instruction Fuzzy Hash: BE61613580114DAFCF16EBE1CE92AEDB775AF95300F648169E406771A2EB306F49CB60

Function 00A5ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00A5ED91
EmptyClipboard.USER32 ref: 00A5ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00A5EDAC
CloseClipboard.USER32 ref: 00A5EEA3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: eae64d8ee5345d525dfd9453660aea891cd1caf783117648d19c8b72fcb161cf
Instruction ID: bacbf83b375e761de5932be3749a12a9e16e5d71c92d4b828120626b660d4519
Opcode Fuzzy Hash: eae64d8ee5345d525dfd9453660aea891cd1caf783117648d19c8b72fcb161cf
Instruction Fuzzy Hash: 0B41FF35204211AFE724DF55E889F19BBE4FF44329F04C09DE8298B6A2C731ED82CB80

Function 00A4E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00A416C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A4170D
Part of subcall function 00A416C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A4173A
Part of subcall function 00A416C3: GetLastError.KERNEL32 ref: 00A4174A

ExitWindowsEx.USER32(?,00000000), ref: 00A4E932

Strings

, xrefs: 00A4E920
SeShutdownPrivilege, xrefs: 00A4E902
@, xrefs: 00A4E925
, xrefs: 00A4E95C

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 43a8a404c17fce693bdd7f28502d390b88ffbbbabdd0857a41a2c799314f0cf5
Instruction ID: 3d6c4f7a94fa13716782ce8239179c5df8ab22039b01f4f2de3d16a57cfde3e0
Opcode Fuzzy Hash: 43a8a404c17fce693bdd7f28502d390b88ffbbbabdd0857a41a2c799314f0cf5
Instruction Fuzzy Hash: 5D01493B710210BBEB64A3B49C86FBFB2ACB784750F154821FC13E31D3E6A15C808290

Function 00A61204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 00A61276
WSAGetLastError.WSOCK32 ref: 00A61283
bind.WSOCK32(00000000,?,00000010), ref: 00A612BA
WSAGetLastError.WSOCK32 ref: 00A612C5
closesocket.WSOCK32(00000000), ref: 00A612F4
listen.WSOCK32(00000000,00000005), ref: 00A61303
WSAGetLastError.WSOCK32 ref: 00A6130D
closesocket.WSOCK32(00000000), ref: 00A6133C

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 58ece7193e0494c7e20f9fa71833cdf3dfb5fbd2b27b8cd9b7a0adfb40fd5a1b
Instruction ID: aa81aff94f4c94df7bf05ae7479d3094904d812ec1b35d63bb393a9e76b6e9d3
Opcode Fuzzy Hash: 58ece7193e0494c7e20f9fa71833cdf3dfb5fbd2b27b8cd9b7a0adfb40fd5a1b
Instruction Fuzzy Hash: 774171716001409FD710DF64C898B6ABBF5AF86328F1C819CE9569F296C771ED82CBE1

Function 00A4D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009E3A97,?,?,009E2E7F,?,?,?,00000000), ref: 009E3AC2

Part of subcall function 00A4E199: GetFileAttributesW.KERNEL32(?,00A4CF95), ref: 00A4E19A

FindFirstFileW.KERNEL32(?,?), ref: 00A4D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00A4D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A4D481
FindClose.KERNEL32(00000000), ref: 00A4D498
FindClose.KERNEL32(00000000), ref: 00A4D4A1

Strings

\*.*, xrefs: 00A4D3F2

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: c7508ed8cc608f0e99f0e311c23008e6f299db9ffe19322ad82c035ea992bd5a
Instruction ID: fbe46edcd32246dfd240cc186b8d325dd7d962e98e0e8877c30d1056578e6458
Opcode Fuzzy Hash: c7508ed8cc608f0e99f0e311c23008e6f299db9ffe19322ad82c035ea992bd5a
Instruction Fuzzy Hash: D3317071008381AFC301EF65C8559AFB7A8BED1314F448A1DF4D5531A1EB20AE49C763

Function 00A1E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00A1E645

Strings

1#QNAN, xrefs: 00A1F84B
1#SNAN, xrefs: 00A1F844
1#INF, xrefs: 00A1F852
1#IND, xrefs: 00A1F83D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 237c3b8bff74c0d9d1f859e6ba171409e7b5b3de7763218a3997d596460ced8b
Instruction ID: b94b619f4184a1c5e6b57c35ed155cccf2d1630d45da524c9737c49ed9dd3738
Opcode Fuzzy Hash: 237c3b8bff74c0d9d1f859e6ba171409e7b5b3de7763218a3997d596460ced8b
Instruction Fuzzy Hash: 9DC22871E086698FDB25CF289D407EAB7B5EB48355F1441EAD84EE7280E774AEC18F40

Function 00A5648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A564DC
CoInitialize.OLE32(00000000), ref: 00A56639
CoCreateInstance.OLE32(00A7FCF8,00000000,00000001,00A7FB68,?), ref: 00A56650
CoUninitialize.OLE32 ref: 00A568D4

Strings

.lnk, xrefs: 00A564BA, 00A56524, 00A565E0

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 45190c051a92ef851fe80e30a01abcbfd19db482654a75a3e00b05480607adae
Instruction ID: 6e51c6668c44b8bd8682635d9ba780180d08e3663c885d2349f600b0c767d2d2
Opcode Fuzzy Hash: 45190c051a92ef851fe80e30a01abcbfd19db482654a75a3e00b05480607adae
Instruction Fuzzy Hash: 40D15A71508241AFC315EF24C881A6BB7E8FFD4705F50496DF5958B2A1EB30EE4ACB92

Function 00A622DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00A622E8

Part of subcall function 00A5E4EC: GetWindowRect.USER32(?,?), ref: 00A5E504

GetDesktopWindow.USER32 ref: 00A62312
GetWindowRect.USER32(00000000), ref: 00A62319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00A62355
GetCursorPos.USER32(?), ref: 00A62381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00A623DF

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 4bee056abae1ff2facf8806d62bd98d2291d126891c710b632b21501190294f8
Instruction ID: 39a12b11c1e7cc9b140e95f422a7725c7957fe6d7f9718984374557133481a0f
Opcode Fuzzy Hash: 4bee056abae1ff2facf8806d62bd98d2291d126891c710b632b21501190294f8
Instruction Fuzzy Hash: AD310072104705AFC720DF54CC48B5BBBA9FF84720F00491DF8889B281DB34EA49CB92

Function 00A59B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00A59B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00A59C8B

Part of subcall function 00A53874: GetInputState.USER32 ref: 00A538CB
Part of subcall function 00A53874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A53966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00A59BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00A59C75

Strings

*.*, xrefs: 00A59B5D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 4ea4f02696452787e9f19f9f370f9fb5f242b6e8ad1a47e8f0f3f5194471bb52
Instruction ID: 8173f28e9453d32480269a735585aac9efbc123faad3a1d58a21393b1cf92762
Opcode Fuzzy Hash: 4ea4f02696452787e9f19f9f370f9fb5f242b6e8ad1a47e8f0f3f5194471bb52
Instruction Fuzzy Hash: E3416171900209EFDF15DFA4C945AEE7BB8FF45311F248155E805A7191EB309E89CF61

Function 009F997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 009F9A4E
GetSysColor.USER32(0000000F), ref: 009F9B23
SetBkColor.GDI32(?,00000000), ref: 009F9B36

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 7f15da9e5c13c7a8def2fd1d7c5e3cf71244889549c877ee202caf8c6f2b3105
Instruction ID: 756262bcc84576a93332b7771f93fb7375ec3081c7dc3e02801a191e73ae47d1
Opcode Fuzzy Hash: 7f15da9e5c13c7a8def2fd1d7c5e3cf71244889549c877ee202caf8c6f2b3105
Instruction Fuzzy Hash: EFA13CB0108448BEE738EB3C8C99F7F369DDB82350F25460AF612C65A2CA29DD41D371

Function 00A61806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A6304E: inet_addr.WSOCK32(?), ref: 00A6307A
Part of subcall function 00A6304E: _wcslen.LIBCMT ref: 00A6309B

socket.WSOCK32(00000002,00000002,00000011), ref: 00A6185D
WSAGetLastError.WSOCK32 ref: 00A61884
bind.WSOCK32(00000000,?,00000010), ref: 00A618DB
WSAGetLastError.WSOCK32 ref: 00A618E6
closesocket.WSOCK32(00000000), ref: 00A61915

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 1cc997caf08a5dd36aeef6de621126f0a9c0db6694f3152cac7cceed40833859
Instruction ID: 0ac1c434ff691c931898307cf85345a0d88fe171d8d89646a50c44cc4c090b35
Opcode Fuzzy Hash: 1cc997caf08a5dd36aeef6de621126f0a9c0db6694f3152cac7cceed40833859
Instruction Fuzzy Hash: 8A51C671A00200AFDB11EF64C886F2A7BE5AB84718F08845CF9559F3D3D771AD42CBA1

Function 00A71C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00A71CC0
IsWindowEnabled.USER32 ref: 00A71CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00A71CDB
IsIconic.USER32 ref: 00A71CE9
IsZoomed.USER32 ref: 00A71CF7

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: c8496ee09d24c9a089c8c2086fe348d14b76db95c572f371e15d0dffca4e5b59
Instruction ID: f80f2c19fed323bb8a35207a51a555594d9c655bdcc8fdca11392589ded0dea9
Opcode Fuzzy Hash: c8496ee09d24c9a089c8c2086fe348d14b76db95c572f371e15d0dffca4e5b59
Instruction Fuzzy Hash: 31218B317402509FD7228F6EDC84B6A7BE5EF85325B19C46CE84E8B252DB71EC42CB90

Function 009E8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 009E83E8
VUUU, xrefs: 00A25DF0
ERCP, xrefs: 009E813C
VUUU, xrefs: 009E83FA
VUUU, xrefs: 009E843C

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 18cad0513194226a84694f08e1881d2fd0488ca845048a5d2814a9f5508690f4
Instruction ID: 25654398dcd502cf535d93bb361b21b0517a1bde6ef43f8437014f59a3154028
Opcode Fuzzy Hash: 18cad0513194226a84694f08e1881d2fd0488ca845048a5d2814a9f5508690f4
Instruction Fuzzy Hash: 01A29270E0066ACBDF25CF99D9407AEB7B2FF54310F2485A9E819A7285EB349D81CF50

Function 00A6A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A6A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00A6A6BA

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Process32NextW.KERNEL32(00000000,?), ref: 00A6A79C
CloseHandle.KERNEL32(00000000), ref: 00A6A7AB

Part of subcall function 009FCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00A23303,?), ref: 009FCE8A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: ffc740715d4ecc269c379eda10ab6c06dfdbd37d6f63a90c33a7dc07a549b986
Instruction ID: 4e80cbe09b119565e92a2f329a7626133ef975f38b996e2a34d0472808e71096
Opcode Fuzzy Hash: ffc740715d4ecc269c379eda10ab6c06dfdbd37d6f63a90c33a7dc07a549b986
Instruction Fuzzy Hash: AC513971508340AFD311EF25C886A6BBBE8EFC9754F40892DF59997262EB30DD04CB92

Function 00A4AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00A4AAAC
SetKeyboardState.USER32(00000080), ref: 00A4AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00A4AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00A4AB88

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 50eaacf608a5f46758b27de0c05a66ff08817b3c19f7e4b7c268ec543ea45349
Instruction ID: ae4ef7280b2c12479831f0de3f47372c80af67904516013d0aa8a8cecdc57a64
Opcode Fuzzy Hash: 50eaacf608a5f46758b27de0c05a66ff08817b3c19f7e4b7c268ec543ea45349
Instruction Fuzzy Hash: CC31F474AC0248AEFB35CB648C05BFA7BA6EBE4320F04821AF585961D1D3758D92C762

Function 00A1BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A1BB7F

Part of subcall function 00A129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000), ref: 00A129DE
Part of subcall function 00A129C8: GetLastError.KERNEL32(00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000,00000000), ref: 00A129F0

GetTimeZoneInformation.KERNEL32 ref: 00A1BB91
WideCharToMultiByte.KERNEL32(00000000,?,00AB121C,000000FF,?,0000003F,?,?), ref: 00A1BC09
WideCharToMultiByte.KERNEL32(00000000,?,00AB1270,000000FF,?,0000003F,?,?,?,00AB121C,000000FF,?,0000003F,?,?), ref: 00A1BC36

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: e7211f56b29311d3ee66f6c832281a26286cb7cc7a7472c6075c81321eff48e6
Instruction ID: 6963ca503ac17453e9b1055435bb2788c36f72d38b75b67673d11d8dd4814d33
Opcode Fuzzy Hash: e7211f56b29311d3ee66f6c832281a26286cb7cc7a7472c6075c81321eff48e6
Instruction Fuzzy Hash: 2D31C170908205DFCB10DFA9CC909EDBBB8FF4575075442AAE020DB2B2D7309D92DBA0

Function 00A5CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00A5CE89
GetLastError.KERNEL32(?,00000000), ref: 00A5CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00A5CEFE

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: fcd1db116bf7ff6fce009706a531be53caa3ce5ff9f48ec8f4fd979562eac110
Instruction ID: 720456567f574fc8e3fdc4ba7d25648e9538cd9540182824662160de33b00af8
Opcode Fuzzy Hash: fcd1db116bf7ff6fce009706a531be53caa3ce5ff9f48ec8f4fd979562eac110
Instruction Fuzzy Hash: 5B219D71500305AFE720DFA5D949BA6B7FCFB40365F10881EE946A2191E770EE498B90

Function 00A48298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00A482AA

Strings

|, xrefs: 00A482DA
(, xrefs: 00A482F0

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 123db7ed6597fb4fa1eb4d8b629cd3e65ddee7ac656a2948fe0dccff53dfc453
Instruction ID: aab261b85c3b1d191b5e2c77e244645e3e03e2f305a41cb3f53e9eb42dc660d9
Opcode Fuzzy Hash: 123db7ed6597fb4fa1eb4d8b629cd3e65ddee7ac656a2948fe0dccff53dfc453
Instruction Fuzzy Hash: F9323779A00605DFC728CF19D480A6AB7F0FF88710B15C56EE59ADB3A1EB74E981CB40

Function 00A55C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A55CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00A55D17
FindClose.KERNEL32(?), ref: 00A55D5F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: d5c2f9352185661c1caccd8433a464bfb0b2324a5a5d7c36010004517e9b331d
Instruction ID: 3acf8b02b735c4bcf52f9676d19f55e49ec43688a4aef6b1b57a3594f6a3718a
Opcode Fuzzy Hash: d5c2f9352185661c1caccd8433a464bfb0b2324a5a5d7c36010004517e9b331d
Instruction Fuzzy Hash: DE51AC76A04A019FC714CF28C494A9AB7F4FF49324F14855DE99A8B3A2DB30ED45CF91

Function 00A12622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00A1271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A12724
UnhandledExceptionFilter.KERNEL32(?), ref: 00A12731

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 42998727f921e728722fc076b66434ef8a3db2832873d08a3fca7c37ae89ac0e
Instruction ID: 7c792a6b82e14d5ac94bd184609241f62748c64ad5f141fc836df53c9d2abce5
Opcode Fuzzy Hash: 42998727f921e728722fc076b66434ef8a3db2832873d08a3fca7c37ae89ac0e
Instruction Fuzzy Hash: E831B57491121C9BCB21DF68DD89BDDB7B8AF08310F5041EAE41CA72A1E7349F818F45

Function 00A551CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A551DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00A55238
SetErrorMode.KERNEL32(00000000), ref: 00A552A1

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: df532c91ce26ae00214cedf0666ede676a73a800e1fa8911fcbf6d34df975023
Instruction ID: 115d7436d16fac38dd13c9dd94b8c036a97305234e3ff2127a782781e8b9100b
Opcode Fuzzy Hash: df532c91ce26ae00214cedf0666ede676a73a800e1fa8911fcbf6d34df975023
Instruction Fuzzy Hash: 65314D75A005189FDB00DF94D894EADBBB4FF49314F048099E8099B362DB31EC56CB90

Function 00A416C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 009FFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00A00668
Part of subcall function 009FFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00A00685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A4170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A4173A
GetLastError.KERNEL32 ref: 00A4174A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 0f5ef4e95dac65bd15c1d940665029f6fe9112b3cb4ac73063a1b204887916f0
Instruction ID: 0a6634039f6522dcdd06b4099047df16aa0f9ae473a071e961986f579309a046
Opcode Fuzzy Hash: 0f5ef4e95dac65bd15c1d940665029f6fe9112b3cb4ac73063a1b204887916f0
Instruction Fuzzy Hash: E71191B2504308AFD718DF54DC86E6AB7BDEF84724B20852EE05657691EB70FC828B60

Function 00A4D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00A4D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00A4D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00A4D650

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 75b7e1053c36462b1d360223936cce5ffe9b7775adfea25414f0b3cb0805d313
Instruction ID: 1c3ec406f46743bcd2f411c3cbe46d885c26abb1fcc06743ff6fcbd609a69942
Opcode Fuzzy Hash: 75b7e1053c36462b1d360223936cce5ffe9b7775adfea25414f0b3cb0805d313
Instruction Fuzzy Hash: 5A115E75E05228BFDB10CF99DC45FAFBBBCEB45B60F108165F908E7290D6704A058BA1

Function 00A41663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00A4168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00A416A1
FreeSid.ADVAPI32(?), ref: 00A416B1

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 05e95568dd0f85c48822f18808cebac878eed1aba59f968793cfc6321d400548
Instruction ID: 81b67efaf24c02974ecb6f896c342934941a346c324af15c865485cc979b58ab
Opcode Fuzzy Hash: 05e95568dd0f85c48822f18808cebac878eed1aba59f968793cfc6321d400548
Instruction Fuzzy Hash: A3F0F475950309FBDB00DFE49C89EAEBBBCFB08615F508565E501E2181E774AA858BA0

Function 00A04CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00A128E9,?,00A04CBE,00A128E9,00AA88B8,0000000C,00A04E15,00A128E9,00000002,00000000,?,00A128E9), ref: 00A04D09
TerminateProcess.KERNEL32(00000000,?,00A04CBE,00A128E9,00AA88B8,0000000C,00A04E15,00A128E9,00000002,00000000,?,00A128E9), ref: 00A04D10
ExitProcess.KERNEL32 ref: 00A04D22

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 59c727f30904dece9415e0c3a79b9f05acaae999e29cb2bdbfe6afdf05e3777d
Instruction ID: 4fe5774653dcfea5d2b827e25cdca2205f11064f22993f884043688036d7a1de
Opcode Fuzzy Hash: 59c727f30904dece9415e0c3a79b9f05acaae999e29cb2bdbfe6afdf05e3777d
Instruction Fuzzy Hash: A0E0B671000248BFDF11AF94EE09A597B69FB45796B108018FD199A172CB35DD82CA80

Function 00A3D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00A3D28C

Strings

X64, xrefs: 00A3D2A8

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: d1925b7f0d1c076a903880007f7c41ff623835e5c5b26e772216058e869ee6b7
Instruction ID: 087bd8c26d1bfda41dc7924efa1e3936b8d442c42f165cb13d4cbba81f96e3d5
Opcode Fuzzy Hash: d1925b7f0d1c076a903880007f7c41ff623835e5c5b26e772216058e869ee6b7
Instruction Fuzzy Hash: A1D0C9B480112DEACF90CB90EC88DDAB37CBB04305F104555F506A2000DB3495498F10

Function 00A0CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: ab05620733b66ea7c9fdb75b4f69619589b923bc1af1f0051566fb5450d6b507
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: B8021C71E002199FDF14CFA9D9806ADFBF1EF48324F25826AD919E7384D731AE418B94

Function 00A568EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A56918
FindClose.KERNEL32(00000000), ref: 00A56961

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 37c46ca888ed5ee4e6a05c2a37a77f231db8e4ab2d3a78b99cc29a9a8b3c4962
Instruction ID: 7b9dc43494373648122a77e4175f489184d18e713d561f7ab2ccede3f7cedca5
Opcode Fuzzy Hash: 37c46ca888ed5ee4e6a05c2a37a77f231db8e4ab2d3a78b99cc29a9a8b3c4962
Instruction Fuzzy Hash: E411BE716042009FC710DF6AD884A16BBE0FF84329F44C699E8698F2A2CB30EC46CB91

Function 00A537B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00A64891,?,?,00000035,?), ref: 00A537E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00A64891,?,?,00000035,?), ref: 00A537F4

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 2fad425a678dafa1134eff79623f7a8654967098a99a660e7f79d4cfb885aa17
Instruction ID: 00114d28e800de4e2f101f3563a792666322b79bbbcab2826b9eaefbda4e3427
Opcode Fuzzy Hash: 2fad425a678dafa1134eff79623f7a8654967098a99a660e7f79d4cfb885aa17
Instruction Fuzzy Hash: 10F0A7716042242AEA1067B65D49FDB76ADEFC4761F004165B509D2281D960594586B0

Function 00A410BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A411FC), ref: 00A410D4
CloseHandle.KERNEL32(?,?,00A411FC), ref: 00A410E9

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: dc457b9392f73b514b49b5e2f09543ee0097b2c7525b1a31a710162bb075c7c7
Instruction ID: 19cd5f71b280c4b0701d7b835f43a9d29dcbdbaab46f10153c9d1255a67a4ab1
Opcode Fuzzy Hash: dc457b9392f73b514b49b5e2f09543ee0097b2c7525b1a31a710162bb075c7c7
Instruction Fuzzy Hash: 7BE0BF72014610AEF7256B51FC05F7777A9EF44320F14C82DF5A5844B1DB626CD1DB50

Function 009ECAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00A30C40

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: d7b94fb1253d8fd72827fa0f3e4720b80ee960fdad1dd3aa28526f04ede19587
Instruction ID: 5324184fbeaa65fddd619c7c70dc32614e7ca977fa0be2d3c1dd88e380e1a38a
Opcode Fuzzy Hash: d7b94fb1253d8fd72827fa0f3e4720b80ee960fdad1dd3aa28526f04ede19587
Instruction Fuzzy Hash: A332BDB0900258DFCF15DF91C891FEDB7B9BF44304F248459E886AB292DB75AE46CB60

Function 00A1676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00A16766,?,?,00000008,?,?,00A1FEFE,00000000), ref: 00A16998

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e250405222c1cdf4a56b15363ff258cc41c1d7291138a6c0238b11af85f7a147
Instruction ID: 2996d8ac5f2bb413b82e2b0a5830c6c12181096239e06da0ce9f587158eba388
Opcode Fuzzy Hash: e250405222c1cdf4a56b15363ff258cc41c1d7291138a6c0238b11af85f7a147
Instruction Fuzzy Hash: B2B13B76610609DFD715CF28C48ABA57BF0FF45364F298658E899CF2A2C335E991CB40

Function 009FB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00A3851F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 91655e0784f24cfa85dbb8dfd3d3699235c75eeda9e79e364058162b20ca15de
Instruction ID: dd0332be86c1a33d5810981e83f91aac4939ba944312d400222eb54cd34ddb87
Opcode Fuzzy Hash: 91655e0784f24cfa85dbb8dfd3d3699235c75eeda9e79e364058162b20ca15de
Instruction Fuzzy Hash: 85125E75A002299FCB14CF58C980AFEB7B5FF48710F14819AE949EB255EB749E81CF90

Function 00A5EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00A5EABD

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: d9c1978ed88bc83b479cd85b38e4a87b75ca7e0f8eb39500949c74dc43aed96f
Instruction ID: d9a9da1b119f6875662674edb82c8c7be05c75a9ac2b868c0d0ae0d24787db10
Opcode Fuzzy Hash: d9c1978ed88bc83b479cd85b38e4a87b75ca7e0f8eb39500949c74dc43aed96f
Instruction Fuzzy Hash: 97E01A712002049FC710EF6AD844E9AB7EDBF987A1F00841AFD4AC7251DA70AD458B90

Function 00A009D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00A003EE), ref: 00A009DA

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d0aebdea70b2bc279638f5f655aa4dc100e441262422c1a791f7fb631f813286
Instruction ID: 480c1d88e8da447da12a618401068ccc95c7d3d21a0556299cd87bb0469b740b
Opcode Fuzzy Hash: d0aebdea70b2bc279638f5f655aa4dc100e441262422c1a791f7fb631f813286
Instruction Fuzzy Hash:

Function 00A0781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00A0798B

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 92a2e7fdde2b59904da5bf87b43e998adec83c1baf2e4b1280d9a8fbfcb98dfe
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: F9518B71E0C70D5BDB788768B99DBBE23D59B42380F188509D882C72C2C635FE89D366

Function 00A16DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7d2a052a8212427bcac66e25ace3ae7dec0e1bcb513b3c1b1ed00bf02977f4
Instruction ID: fcd371b7595c2d299702ca1c1c026d069120873e8c4317885c37c9d17514c2ae
Opcode Fuzzy Hash: 2e7d2a052a8212427bcac66e25ace3ae7dec0e1bcb513b3c1b1ed00bf02977f4
Instruction Fuzzy Hash: 9E322232D29F014DD7239634C822379A6A9AFB73D5F15E737E81AB59A5EB39C4C34200

Function 009FCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f31b44adf8f6db5eaa2528553d62d572d0e125b63c8c44cec57799cfa446e65
Instruction ID: dca32b2d5c34fe7a9c695ff292adcacf7efa0ff53d6e33e6293c17be1a64c2ae
Opcode Fuzzy Hash: 6f31b44adf8f6db5eaa2528553d62d572d0e125b63c8c44cec57799cfa446e65
Instruction Fuzzy Hash: 7C322772A0015D8BDF28CF29CD9067DB7B1EF45361F28896AF989AB291D334DD81DB40

Function 009E7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21ee6c908231047d80a176ee7a93fc77f2bb44228c034ed3b33679b9c16ee4d
Instruction ID: a69a7b4cce122cf93b2ca67a6c7ee60123068cc2bf08234fbc1bf51ee837894c
Opcode Fuzzy Hash: f21ee6c908231047d80a176ee7a93fc77f2bb44228c034ed3b33679b9c16ee4d
Instruction Fuzzy Hash: 8422AE70E0461ADFDF14CFA9D881AAEF3B6FF44300F244529E816AB291E735AD51CB51

Function 009E91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca41bb85524ed4cb01fbeb468e4c7282ba233aa8ab851b9716c7368e60c579ce
Instruction ID: 9b13bff0430979b8aa854dcf531c00e0143932dfbacf7ce09ab6bff67a754982
Opcode Fuzzy Hash: ca41bb85524ed4cb01fbeb468e4c7282ba233aa8ab851b9716c7368e60c579ce
Instruction Fuzzy Hash: 4E02B6B1A00219EFDF05DF59D981BAEB7B1FF44300F108169E9169B291EB31EE51CB91

Function 00A19EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1166e76f9d1fef9956c69b21e72dd13b3febe00d28e0d1bdbc1087814d0da9d8
Instruction ID: ddc3f1f94cf26924fe48f401307ba3bfc321cc495b36727c201ef5b625652300
Opcode Fuzzy Hash: 1166e76f9d1fef9956c69b21e72dd13b3febe00d28e0d1bdbc1087814d0da9d8
Instruction Fuzzy Hash: A9B1E231D2AF414DD72396798831336B65CAFBB6D5F91D71BFC2678D22EB2286834240

Function 00A01C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: c183e7d98c6e6af5172975c4426ce47dbd2cd2f0fe5e53780c212c0e685edbb8
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 79917A725080A74ADB2D473EA5740BEFFF15A923A131A079ED4F2CB1C5FE14D964D620

Function 00A01F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 263700fad7401edf883b6079a57e52b2c4a7201a878879e0850c47c29f136f10
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 359197722082A74ADB2D473D947817EFFF15A923A131A079ED4F2CB1C5EE24C954E720

Function 00A019B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: fea156001271d990031bb39a20b5eeeda96ef5aaf6824e975f56aa6b4dc9fc7c
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 4A9130722090A74ADB2D477AA5740BEFFF15A923A231A079ED4F2CB1C1FE24D564D620

Function 00A07A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d957b368bda56013a12b2c83fbb5d00f72892b25a2bdbe983ef3e380392726f4
Instruction ID: c8f58f7dd3a1ca3f4481b6339754b127556e6d8a3d12aa8fc3d2ad462e1322e1
Opcode Fuzzy Hash: d957b368bda56013a12b2c83fbb5d00f72892b25a2bdbe983ef3e380392726f4
Instruction Fuzzy Hash: 89615831F0874D66EA349B28B9A5BBE33A4DF42750F500919E883DB2C1DA75BE42C365

Function 00A07CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113c87d7a73f29463e24b7c190844594f18b0d1e8a27072c14e12ced1bc88870
Instruction ID: 384ec7fc33bec750782e81e0d3d1e683385985cd3d404658e9db13b9cb13678e
Opcode Fuzzy Hash: 113c87d7a73f29463e24b7c190844594f18b0d1e8a27072c14e12ced1bc88870
Instruction Fuzzy Hash: C3617B71E0870D67DE388B28B995BBF2394EF42744F100959E982DB2C1EA36FD42CB55

Function 00A01706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 176f8fb9084088e738d4344cad15376455f55b6d27cc2a6633c31aa6e233f163
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 868194326080A74EDB2D437A95744BEFFE15A923A131A079DD4F2CB1C1FE24C658E660

Function 00A52046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd23bc8f727b4b489f07efcc604cef0e7781d78eb2903f203eb22b011352d062
Instruction ID: bf490d8013244f9530c332c562519f836dea7e588d571dd09469c8b3d0433b36
Opcode Fuzzy Hash: dd23bc8f727b4b489f07efcc604cef0e7781d78eb2903f203eb22b011352d062
Instruction Fuzzy Hash: 4B2193326216158BDB28CF79C82277A73E5B754310F158A2EE4A7C77D1DE36A904CB80

Function 00A62ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00A62B30
DeleteObject.GDI32(00000000), ref: 00A62B43
DestroyWindow.USER32 ref: 00A62B52
GetDesktopWindow.USER32 ref: 00A62B6D
GetWindowRect.USER32(00000000), ref: 00A62B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00A62CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00A62CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62CF8
GetClientRect.USER32(00000000,?), ref: 00A62D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00A62D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62DA8
GlobalFree.KERNEL32(00000000), ref: 00A62DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00A7FC38,00000000), ref: 00A62DDB
GlobalFree.KERNEL32(00000000), ref: 00A62DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00A62E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00A62E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A6303F

Strings

DISPLAY, xrefs: 00A62EA2
, xrefs: 00A62FC5
static, xrefs: 00A62D3A, 00A62E91
AutoIt v3, xrefs: 00A62CF2

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 58b38a7498c9d731ef27950495f3a7dbe02b715600eaa011eb1d1f50c3f96651
Instruction ID: 0d7d91595b382355678b2229fad4a4a14feb0663340c44b7e3155764efff65e8
Opcode Fuzzy Hash: 58b38a7498c9d731ef27950495f3a7dbe02b715600eaa011eb1d1f50c3f96651
Instruction Fuzzy Hash: 7F026D75500205EFDB14DFA4CC89EAE7BB9FF48720F048558F919AB2A1DB74AD42CB60

Function 00A770D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00A7712F
GetSysColorBrush.USER32(0000000F), ref: 00A77160
GetSysColor.USER32(0000000F), ref: 00A7716C
SetBkColor.GDI32(?,000000FF), ref: 00A77186
SelectObject.GDI32(?,?), ref: 00A77195
InflateRect.USER32(?,000000FF,000000FF), ref: 00A771C0
GetSysColor.USER32(00000010), ref: 00A771C8
CreateSolidBrush.GDI32(00000000), ref: 00A771CF
FrameRect.USER32(?,?,00000000), ref: 00A771DE
DeleteObject.GDI32(00000000), ref: 00A771E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00A77230
FillRect.USER32(?,?,?), ref: 00A77262
GetWindowLongW.USER32(?,000000F0), ref: 00A77284

Part of subcall function 00A773E8: GetSysColor.USER32(00000012), ref: 00A77421
Part of subcall function 00A773E8: SetTextColor.GDI32(?,?), ref: 00A77425
Part of subcall function 00A773E8: GetSysColorBrush.USER32(0000000F), ref: 00A7743B
Part of subcall function 00A773E8: GetSysColor.USER32(0000000F), ref: 00A77446
Part of subcall function 00A773E8: GetSysColor.USER32(00000011), ref: 00A77463
Part of subcall function 00A773E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A77471
Part of subcall function 00A773E8: SelectObject.GDI32(?,00000000), ref: 00A77482
Part of subcall function 00A773E8: SetBkColor.GDI32(?,00000000), ref: 00A7748B
Part of subcall function 00A773E8: SelectObject.GDI32(?,?), ref: 00A77498
Part of subcall function 00A773E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00A774B7
Part of subcall function 00A773E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A774CE
Part of subcall function 00A773E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00A774DB

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 4f730625cb094b7b8e9fdc20f562f62dbc8e08d4e174ed1e537e5332ae5fbe12
Instruction ID: 158d255baf4ec816adbd6ab55eca7b865a800f6ee2c60e8ac74fe3b2e48197f0
Opcode Fuzzy Hash: 4f730625cb094b7b8e9fdc20f562f62dbc8e08d4e174ed1e537e5332ae5fbe12
Instruction Fuzzy Hash: 8FA18F72008301AFD710DFA0DC48A6F7BA9FB49331F508B2DF96A961A1D771E985CB91

Function 009F8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 009F8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00A36AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00A36AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00A36F43

Part of subcall function 009F8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009F8BE8,?,00000000,?,?,?,?,009F8BBA,00000000,?), ref: 009F8FC5

SendMessageW.USER32(?,00001053), ref: 00A36F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00A36F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00A36FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00A36FB7

Strings

0, xrefs: 00A36DCF

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: c4ec6abd789ef34a84f0224e0ebbba4682d6be41c7f72d30d86e3455e37f2860
Instruction ID: e630e137dd5fe26f2269535b5fe91206d0a26b5e628bf8f45943880830d3a119
Opcode Fuzzy Hash: c4ec6abd789ef34a84f0224e0ebbba4682d6be41c7f72d30d86e3455e37f2860
Instruction Fuzzy Hash: 9612AA30200641EFDB25DF24D894BBABBE5FB45310F548569F5898B262CB36EC92CF91

Function 00A62711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00A6273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00A6286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00A628A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00A628B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00A62900
GetClientRect.USER32(00000000,?), ref: 00A6290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00A62955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00A62964
GetStockObject.GDI32(00000011), ref: 00A62974
SelectObject.GDI32(00000000,00000000), ref: 00A62978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00A62988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A62991
DeleteDC.GDI32(00000000), ref: 00A6299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00A629C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00A629DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00A62A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00A62A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00A62A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00A62A77
GetStockObject.GDI32(00000011), ref: 00A62A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00A62A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00A62A97

Strings

DISPLAY, xrefs: 00A6295A
static, xrefs: 00A6294F, 00A62A71
msctls_progress32, xrefs: 00A62A13
AutoIt v3, xrefs: 00A628F8

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: b3f92983571fb6a5c20d4394bfb2f6ad6e45b9c87c3cf4ff1b3ed90dd46c3812
Instruction ID: 8f2c1d2ca6ad99b2edb67a8ff7fe3185b5216689d8036f2b9595dc9ba3b0b561
Opcode Fuzzy Hash: b3f92983571fb6a5c20d4394bfb2f6ad6e45b9c87c3cf4ff1b3ed90dd46c3812
Instruction Fuzzy Hash: BBB17E71A00605AFEB14DFA9CC45FAE7BB9EB48710F108618F915EB2A1DB70ED41CB94

Function 00A54ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A54AED
GetDriveTypeW.KERNEL32(?,00A7CB68,?,\\.\,00A7CC08), ref: 00A54BCA
SetErrorMode.KERNEL32(00000000,00A7CB68,?,\\.\,00A7CC08), ref: 00A54D36

Strings

SATA, xrefs: 00A54CD0
\\.\, xrefs: 00A54B3F
iSCSI, xrefs: 00A54CC2
SSD, xrefs: 00A54C4A
Unknown, xrefs: 00A54BED, 00A54C83
SSA, xrefs: 00A54CA6
MMC, xrefs: 00A54CDE
PhysicalDrive, xrefs: 00A54B76
Removable, xrefs: 00A54C10, 00A54C15
FileBackedVirtual, xrefs: 00A54CEC
SAS, xrefs: 00A54CC9
ATAPI, xrefs: 00A54C91
1394, xrefs: 00A54C9F
Fixed, xrefs: 00A54C09
RAID, xrefs: 00A54CBB
SCSI, xrefs: 00A54C8A
RAMDisk, xrefs: 00A54BF4
Virtual, xrefs: 00A54CE5
Network, xrefs: 00A54C02
ATA, xrefs: 00A54C98
CDROM, xrefs: 00A54BFB
USB, xrefs: 00A54CB4
Fibre, xrefs: 00A54CAD

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: e18399fb3ce61a3ca3bc8a24e12582a9dcf624a383699805df61d648f66a97b1
Instruction ID: 4a8ab21143b92db8d1d5f26a71e05a5b1e293c7f6fa3103c2bd395205a6d4ce1
Opcode Fuzzy Hash: e18399fb3ce61a3ca3bc8a24e12582a9dcf624a383699805df61d648f66a97b1
Instruction Fuzzy Hash: C361A030605605BBCB04DF24CA8196DB7B1BB8D78EB288415FC06AB691DB35EDC9DF41

Function 00A773E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00A77421
SetTextColor.GDI32(?,?), ref: 00A77425
GetSysColorBrush.USER32(0000000F), ref: 00A7743B
GetSysColor.USER32(0000000F), ref: 00A77446
CreateSolidBrush.GDI32(?), ref: 00A7744B
GetSysColor.USER32(00000011), ref: 00A77463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A77471
SelectObject.GDI32(?,00000000), ref: 00A77482
SetBkColor.GDI32(?,00000000), ref: 00A7748B
SelectObject.GDI32(?,?), ref: 00A77498
InflateRect.USER32(?,000000FF,000000FF), ref: 00A774B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A774CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00A774DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A7752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00A77554
InflateRect.USER32(?,000000FD,000000FD), ref: 00A77572
DrawFocusRect.USER32(?,?), ref: 00A7757D
GetSysColor.USER32(00000011), ref: 00A7758E
SetTextColor.GDI32(?,00000000), ref: 00A77596
DrawTextW.USER32(?,00A770F5,000000FF,?,00000000), ref: 00A775A8
SelectObject.GDI32(?,?), ref: 00A775BF
DeleteObject.GDI32(?), ref: 00A775CA
SelectObject.GDI32(?,?), ref: 00A775D0
DeleteObject.GDI32(?), ref: 00A775D5
SetTextColor.GDI32(?,?), ref: 00A775DB
SetBkColor.GDI32(?,?), ref: 00A775E5

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 0a36beadfb5e6ff8c685c7d4e8b11693c2df46a00ef547bf5e82da28e2b8975b
Instruction ID: 56d7710ab8784e3073aa024b3cfdf9f35aa1c8ce7da8d97cd39d1d9d3f46c3af
Opcode Fuzzy Hash: 0a36beadfb5e6ff8c685c7d4e8b11693c2df46a00ef547bf5e82da28e2b8975b
Instruction Fuzzy Hash: A0614072900218AFDF11DFA4DC49EAE7F79EB08320F118125F919AB2A1D7759981CF90

Function 00A70FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00A71128
GetDesktopWindow.USER32 ref: 00A7113D
GetWindowRect.USER32(00000000), ref: 00A71144
GetWindowLongW.USER32(?,000000F0), ref: 00A71199
DestroyWindow.USER32(?), ref: 00A711B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00A711ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A7120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00A7121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00A71232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00A71245
IsWindowVisible.USER32(00000000), ref: 00A712A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00A712BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00A712D0
GetWindowRect.USER32(00000000,?), ref: 00A712E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00A7130E
GetMonitorInfoW.USER32(00000000,?), ref: 00A71328
CopyRect.USER32(?,?), ref: 00A7133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00A713AA

Strings

(, xrefs: 00A7131B
0, xrefs: 00A710D3
tooltips_class32, xrefs: 00A711E6

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: d8cf0e411c0747d1c6633cca9af3d045e6c74ae8b61dc87c5fbbb841ce7b86ee
Instruction ID: 7347c7ad9777ef88a24f64115e51c15e3e0eb5341f67eb298d062e07ae9399ad
Opcode Fuzzy Hash: d8cf0e411c0747d1c6633cca9af3d045e6c74ae8b61dc87c5fbbb841ce7b86ee
Instruction Fuzzy Hash: 52B15871604341AFD714DF69CC84B6ABBE4EF84354F00C91CF9999B2A1DB31E845CB92

Function 009F8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009F8968
GetSystemMetrics.USER32(00000007), ref: 009F8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009F899B
GetSystemMetrics.USER32(00000008), ref: 009F89A3
GetSystemMetrics.USER32(00000004), ref: 009F89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 009F89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 009F89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 009F8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 009F8A3C
GetClientRect.USER32(00000000,000000FF), ref: 009F8A5A
GetStockObject.GDI32(00000011), ref: 009F8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 009F8A81

Part of subcall function 009F912D: GetCursorPos.USER32(?), ref: 009F9141
Part of subcall function 009F912D: ScreenToClient.USER32(00000000,?), ref: 009F915E
Part of subcall function 009F912D: GetAsyncKeyState.USER32(00000001), ref: 009F9183
Part of subcall function 009F912D: GetAsyncKeyState.USER32(00000002), ref: 009F919D

SetTimer.USER32(00000000,00000000,00000028,009F90FC), ref: 009F8AA8

Strings

AutoIt v3 GUI, xrefs: 009F8A20

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 94ef94bc136b78acc2f05046ccbf2f1f294641ed08c7bc7886a1c01225e11e3d
Instruction ID: 94f1a1a53080aa3a6d90a5883b63e11754118fa0cfebc2fcb7ceb5d6027af9a0
Opcode Fuzzy Hash: 94ef94bc136b78acc2f05046ccbf2f1f294641ed08c7bc7886a1c01225e11e3d
Instruction Fuzzy Hash: 43B16E71A00209AFDF14DFA8CC99BAE7BB5FB48314F108229FA15A7290DB74E941CF51

Function 00A40D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A410F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A41114
Part of subcall function 00A410F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A41120
Part of subcall function 00A410F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A4112F
Part of subcall function 00A410F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A41136
Part of subcall function 00A410F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A4114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A40DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A40E29
GetLengthSid.ADVAPI32(?), ref: 00A40E40
GetAce.ADVAPI32(?,00000000,?), ref: 00A40E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A40E96
GetLengthSid.ADVAPI32(?), ref: 00A40EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00A40EB5
HeapAlloc.KERNEL32(00000000), ref: 00A40EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A40EDD
CopySid.ADVAPI32(00000000), ref: 00A40EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A40F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A40F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A40F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A40F6E
HeapFree.KERNEL32(00000000), ref: 00A40F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A40F7E
HeapFree.KERNEL32(00000000), ref: 00A40F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A40F8E
HeapFree.KERNEL32(00000000), ref: 00A40F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00A40FA1
HeapFree.KERNEL32(00000000), ref: 00A40FA8

Part of subcall function 00A41193: GetProcessHeap.KERNEL32(00000008,00A40BB1,?,00000000,?,00A40BB1,?), ref: 00A411A1
Part of subcall function 00A41193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00A40BB1,?), ref: 00A411A8
Part of subcall function 00A41193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00A40BB1,?), ref: 00A411B7

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 7ec6862f18a0ba066b74174a390c0f8aa6c58e131ca2129dca5b4ef6cb02eef1
Instruction ID: f8f051fe5a4acb0b869f7a13d60fb8e7b42f63a3b176b0e8fe08a96d7f4e8d80
Opcode Fuzzy Hash: 7ec6862f18a0ba066b74174a390c0f8aa6c58e131ca2129dca5b4ef6cb02eef1
Instruction Fuzzy Hash: 99719F7590021AABDF20DFA4DC45FAEBBB8BF44310F048129FA19E7191D7749946DBA0

Function 00A6C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A6C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00A7CC08,00000000,?,00000000,?,?), ref: 00A6C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00A6C5A4
_wcslen.LIBCMT ref: 00A6C5F4
_wcslen.LIBCMT ref: 00A6C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00A6C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00A6C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00A6C84D
RegCloseKey.ADVAPI32(?), ref: 00A6C881
RegCloseKey.ADVAPI32(00000000), ref: 00A6C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00A6C960

Strings

REG_SZ, xrefs: 00A6C644
REG_EXPAND_SZ, xrefs: 00A6C5CD
REG_MULTI_SZ, xrefs: 00A6C6F5
REG_QWORD, xrefs: 00A6C8C3
REG_BINARY, xrefs: 00A6C913
REG_DWORD, xrefs: 00A6C804

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 3621238ba0c263ae9a3bdc0a136bbc8f55b705662a71bcf28795d5b98615bade
Instruction ID: 039bc78230ab3f955d4e27878a55f156f25b8e01aaf438f23384a70b44ec84d7
Opcode Fuzzy Hash: 3621238ba0c263ae9a3bdc0a136bbc8f55b705662a71bcf28795d5b98615bade
Instruction Fuzzy Hash: FA124575604241AFD715DF25C885B2AB7F5FF88724F04889CF89A9B2A2DB31ED41CB81

Function 00A7091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A709C6
_wcslen.LIBCMT ref: 00A70A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A70A54
_wcslen.LIBCMT ref: 00A70A8A
_wcslen.LIBCMT ref: 00A70B06
_wcslen.LIBCMT ref: 00A70B81

Part of subcall function 009FF9F2: _wcslen.LIBCMT ref: 009FF9FD

Part of subcall function 00A42BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A42BFA

Strings

CHECK, xrefs: 00A70A85, 00A70AA0
EXISTS, xrefs: 00A70B7C, 00A70B97
SELECT, xrefs: 00A70D11
GETTOTALCOUNT, xrefs: 00A709F2, 00A70A17
GETSELECTED, xrefs: 00A70C4E
UNCHECK, xrefs: 00A70D3E
GETTEXT, xrefs: 00A70C97
GETITEMCOUNT, xrefs: 00A70C1E
COLLAPSE, xrefs: 00A70B01, 00A70B1C
EXPAND, xrefs: 00A70BF8
ISCHECKED, xrefs: 00A70CE1

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 03a481edd71b4a61d69bfaf6c2c426d769eda3f7e97108f0b5408cb7095347c1
Instruction ID: 72e00ee7dd8af2a1898e36f8dd6d865769b24cc908e75eda857e8c29d64a64dd
Opcode Fuzzy Hash: 03a481edd71b4a61d69bfaf6c2c426d769eda3f7e97108f0b5408cb7095347c1
Instruction Fuzzy Hash: 9CE15475208741DFCB14DF25C850A2AB7E2BFD8354F14C958F89A9B2A2DB30EE45CB81

Function 00A6C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A6B6AE,?,?), ref: 00A6C9B5
_wcslen.LIBCMT ref: 00A6C9F1
_wcslen.LIBCMT ref: 00A6CA68
_wcslen.LIBCMT ref: 00A6CA9E
_wcslen.LIBCMT ref: 00A6CAF9
_wcslen.LIBCMT ref: 00A6CB2F
_wcslen.LIBCMT ref: 00A6CB7F

Strings

HKEY_CURRENT_USER, xrefs: 00A6CBBD
HKEY_USERS, xrefs: 00A6CBDF
HKEY_CURRENT_CONFIG, xrefs: 00A6CB79, 00A6CB7E
HKLM, xrefs: 00A6CA98, 00A6CA9D
HKEY_CLASSES_ROOT, xrefs: 00A6CAF3, 00A6CAF8
HKCR, xrefs: 00A6CB29, 00A6CB2E
HKEY_LOCAL_MACHINE, xrefs: 00A6CA62, 00A6CA67
HKCU, xrefs: 00A6CBCE
HKCC, xrefs: 00A6CBAC
HKU, xrefs: 00A6CBF0

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 4ea28728903252ff66297d24e5e54d44d9b420d77f8464de386a10ed16a2398e
Instruction ID: 10627ba1e7541bf5e901f00fc1e58f8d74f82b59a2ca5bfd6ee4e1b68b36af34
Opcode Fuzzy Hash: 4ea28728903252ff66297d24e5e54d44d9b420d77f8464de386a10ed16a2398e
Instruction Fuzzy Hash: 8071D63261016A8BCB20DFACCD516BF33B2AFA57B4B150528F8A597284E735CD8583A0

Function 00A7833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A7835A
_wcslen.LIBCMT ref: 00A7836E
_wcslen.LIBCMT ref: 00A78391
_wcslen.LIBCMT ref: 00A783B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00A783F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00A7361A,?), ref: 00A7844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A78487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00A784CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A78501
FreeLibrary.KERNEL32(?), ref: 00A7850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00A7851D
DestroyIcon.USER32(?), ref: 00A7852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00A78549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00A78555

Strings

.icl, xrefs: 00A78368
.exe, xrefs: 00A78388
.dll, xrefs: 00A783AB

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 2ff4c4f8795f273142b90d72ea9e77f0c024db0be94a704224b937bcfa0ae47f
Instruction ID: ec2af1637f89374f50d3bdd471c464322bd224e65b89ab66406c05f925fa066b
Opcode Fuzzy Hash: 2ff4c4f8795f273142b90d72ea9e77f0c024db0be94a704224b937bcfa0ae47f
Instruction Fuzzy Hash: 8A61D2B1580619BAEB14DF64DC49BBF77A8BB08B21F10C509F919D60D1DFB8A981C7A0

Function 009E7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#include, xrefs: 009E7847
', xrefs: 00A25169
#comments-start, xrefs: 009E785F, 009E78B1
#ce, xrefs: 009E78ED
Unterminated group of comments, xrefs: 00A2528C
#cs, xrefs: 009E7873, 009E78C5
#comments-end, xrefs: 009E78D9
Bad directive syntax error, xrefs: 00A2519A
Cannot parse #include, xrefs: 00A25279
", xrefs: 00A25153
#requireadmin, xrefs: 009E77FF
#notrayicon, xrefs: 009E77E7
#OnAutoItStartRegister, xrefs: 009E7817
#include-once, xrefs: 009E782F
#pragma compile, xrefs: 009E77D3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 4f11d857f05ea9d11c9ad4fcd987f66fb7db3f013bf6f37c65a54d24461e57c9
Instruction ID: a8c39f7eb94877ddba52ad53f69b47b993a034b34f47c0df42d0336b16f5354a
Opcode Fuzzy Hash: 4f11d857f05ea9d11c9ad4fcd987f66fb7db3f013bf6f37c65a54d24461e57c9
Instruction Fuzzy Hash: 6A811770A00215BBDB22AFA5DD42FBF7768BF55300F048424F908AA1D2EB75DE51C7A2

Function 00A53E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00A53EF8
_wcslen.LIBCMT ref: 00A53F03
_wcslen.LIBCMT ref: 00A53F5A
_wcslen.LIBCMT ref: 00A53F98
GetDriveTypeW.KERNEL32(?), ref: 00A53FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A5401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A54059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A54087

Strings

open, xrefs: 00A53F54, 00A53F59
open , xrefs: 00A53FE5
close cd wait, xrefs: 00A54072
close, xrefs: 00A53EFE, 00A53F18
closed, xrefs: 00A53F08, 00A53F2D, 00A53F46, 00A53F7E, 00A53F97
type cdaudio alias cd wait, xrefs: 00A54001
wait, xrefs: 00A54044
set cd door , xrefs: 00A54028

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 9785a94de8fb91232bdad081c6677dd1bb110a79de3bf65e4a8ff9bf6b607a6f
Instruction ID: 540ba78783c0158063e815fb8bb9707557a0c9cfdbc968e6d23e16c3f28a828a
Opcode Fuzzy Hash: 9785a94de8fb91232bdad081c6677dd1bb110a79de3bf65e4a8ff9bf6b607a6f
Instruction Fuzzy Hash: 3A71D0726043019FC710EF24C88096AB7F4FF987A8F14492DF996972A1EB30ED49CB91

Function 00A45A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00A45A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00A45A40
SetWindowTextW.USER32(?,?), ref: 00A45A57
GetDlgItem.USER32(?,000003EA), ref: 00A45A6C
SetWindowTextW.USER32(00000000,?), ref: 00A45A72
GetDlgItem.USER32(?,000003E9), ref: 00A45A82
SetWindowTextW.USER32(00000000,?), ref: 00A45A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00A45AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00A45AC3
GetWindowRect.USER32(?,?), ref: 00A45ACC
_wcslen.LIBCMT ref: 00A45B33
SetWindowTextW.USER32(?,?), ref: 00A45B6F
GetDesktopWindow.USER32 ref: 00A45B75
GetWindowRect.USER32(00000000), ref: 00A45B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00A45BD3
GetClientRect.USER32(?,?), ref: 00A45BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00A45C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00A45C2F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 336623dce4c04fcc70803a4a504ecaac796f709e929cb1fea8fc023f86504a38
Instruction ID: 409717f6162391f1971e7348a80d89a36cf94bbe1d7002ce437214f46efd16d0
Opcode Fuzzy Hash: 336623dce4c04fcc70803a4a504ecaac796f709e929cb1fea8fc023f86504a38
Instruction Fuzzy Hash: 10718D35900B09AFDB20DFB8CE89A6EBBF5FF88714F10452CE546A25A1E775E941CB10

Function 00A5FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00A5FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 00A5FE32
LoadCursorW.USER32(00000000,00007F00), ref: 00A5FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 00A5FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 00A5FE53
LoadCursorW.USER32(00000000,00007F01), ref: 00A5FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 00A5FE69
LoadCursorW.USER32(00000000,00007F88), ref: 00A5FE74
LoadCursorW.USER32(00000000,00007F80), ref: 00A5FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 00A5FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 00A5FE95
LoadCursorW.USER32(00000000,00007F85), ref: 00A5FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 00A5FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 00A5FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 00A5FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 00A5FECC
GetCursorInfo.USER32(?), ref: 00A5FEDC
GetLastError.KERNEL32 ref: 00A5FF1E

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: bf7511c3b5d14a4f2dd3326d5c98f7330e4bc1570483f0bd95bda4f43aa3b26e
Instruction ID: c38365484de18e3d06c1164d64ba9bc02574c65c3586ec3f24f82f67d9689340
Opcode Fuzzy Hash: bf7511c3b5d14a4f2dd3326d5c98f7330e4bc1570483f0bd95bda4f43aa3b26e
Instruction Fuzzy Hash: 8D4174B0D043196EDB10DFBA8C8985EBFE8FF04354B50852AE51DE7281DB789905CF90

Function 00A000C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00A000C6

Part of subcall function 00A000ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00AB070C,00000FA0,A40B38BE,?,?,?,?,00A223B3,000000FF), ref: 00A0011C
Part of subcall function 00A000ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00A223B3,000000FF), ref: 00A00127
Part of subcall function 00A000ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00A223B3,000000FF), ref: 00A00138
Part of subcall function 00A000ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00A0014E
Part of subcall function 00A000ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00A0015C
Part of subcall function 00A000ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00A0016A
Part of subcall function 00A000ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00A00195
Part of subcall function 00A000ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00A001A0

___scrt_fastfail.LIBCMT ref: 00A000E7

Part of subcall function 00A000A3: __onexit.LIBCMT ref: 00A000A9

Strings

SleepConditionVariableCS, xrefs: 00A00154
InitializeConditionVariable, xrefs: 00A00148
kernel32.dll, xrefs: 00A00133
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00A00122
WakeAllConditionVariable, xrefs: 00A00162

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 36d7107bc625d090b9a9f34b1e4194e641b4ee8ddf2a390e288a493e9ddfc801
Instruction ID: 2dbcb33a4a9d167f9f8245fdaec34cca99f539bb3c8796b5586175609d58df15
Opcode Fuzzy Hash: 36d7107bc625d090b9a9f34b1e4194e641b4ee8ddf2a390e288a493e9ddfc801
Instruction Fuzzy Hash: E221F9326447147FE7209BF4BC09F6A7394FB45F61F00863AF909A76D2DF7098418A90

Function 00A430F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A4318D
_wcslen.LIBCMT ref: 00A431F8

Strings

CLASS, xrefs: 00A43188, 00A431A5
TEXT, xrefs: 00A4347C
REGEXPCLASS, xrefs: 00A43255, 00A43266
NAME, xrefs: 00A43335, 00A43346
CLASSNN, xrefs: 00A431F3, 00A43204
INSTANCE, xrefs: 00A43453

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 29316e004841237616a2bc8c54f94aeaccfcd72f3ceeb188839c264281d4566d
Instruction ID: 308799b579efe6752cf7649fa3a5a9a3e7f2eed2d02973f9dfa4d58ea2f308dd
Opcode Fuzzy Hash: 29316e004841237616a2bc8c54f94aeaccfcd72f3ceeb188839c264281d4566d
Instruction Fuzzy Hash: 2BE1E437A00516AFCF18DFB8C8517EEBBB0BF94750F548129E556E7280DB70AE8587A0

Function 00A544C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00A7CC08), ref: 00A54527
_wcslen.LIBCMT ref: 00A5453B
_wcslen.LIBCMT ref: 00A54599
_wcslen.LIBCMT ref: 00A545F4
_wcslen.LIBCMT ref: 00A5463F
_wcslen.LIBCMT ref: 00A546A7

Part of subcall function 009FF9F2: _wcslen.LIBCMT ref: 009FF9FD

GetDriveTypeW.KERNEL32(?,00AA6BF0,00000061), ref: 00A54743

Strings

network, xrefs: 00A5469D, 00A546A2
unknown, xrefs: 00A54708
removable, xrefs: 00A545EA, 00A545EF
ramdisk, xrefs: 00A546F1
all, xrefs: 00A54531, 00A54536
fixed, xrefs: 00A54635, 00A5463A
cdrom, xrefs: 00A5458F, 00A54594

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 2f440d56c0f5a204368a86838e132efec8421022a41a7e07b4106275e90b7402
Instruction ID: 85084e01831c68e135114791b21ab7bb1f45138d8b90d92d19efe262f43b23b4
Opcode Fuzzy Hash: 2f440d56c0f5a204368a86838e132efec8421022a41a7e07b4106275e90b7402
Instruction Fuzzy Hash: F4B1E2716083029FC710DF28C890A6AB7E5BFE9769F50491DF896C7291E730DC89CB62

Function 00A63FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00A7CC08), ref: 00A640BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00A640CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00A7CC08), ref: 00A640F2
FreeLibrary.KERNEL32(00000000,?,00A7CC08), ref: 00A6413E
StringFromGUID2.OLE32(?,?,00000028,?,00A7CC08), ref: 00A641A8
SysFreeString.OLEAUT32(00000009), ref: 00A64262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00A642C8
SysFreeString.OLEAUT32(?), ref: 00A642F2

Strings

GetModuleHandleExW, xrefs: 00A640C7
kernel32.dll, xrefs: 00A640B6

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: ba6391e13ddaef001b104a8b217ab0398fe41a8f15a93635129601eb59b1f3d7
Instruction ID: 27520e59f502d647c482d772410861a1dc2730728f22629110ad22538214827b
Opcode Fuzzy Hash: ba6391e13ddaef001b104a8b217ab0398fe41a8f15a93635129601eb59b1f3d7
Instruction Fuzzy Hash: 79123E75A00115EFDB14DF94C888EAEBBB5FF49714F248098F9099B251DB31ED46CBA0

Function 009E326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00AB1990), ref: 00A22F8D
GetMenuItemCount.USER32(00AB1990), ref: 00A2303D
GetCursorPos.USER32(?), ref: 00A23081
SetForegroundWindow.USER32(00000000), ref: 00A2308A
TrackPopupMenuEx.USER32(00AB1990,00000000,?,00000000,00000000,00000000), ref: 00A2309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00A230A9

Strings

0, xrefs: 009E327D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: d3fa8b97905fb0f7051039fad4ea6211bfd94b527a969f9c1697629f1bd984b4
Instruction ID: 67780a49162922cf4d318de1a4e101249212e78104096e0b38ddf3ecf956fee3
Opcode Fuzzy Hash: d3fa8b97905fb0f7051039fad4ea6211bfd94b527a969f9c1697629f1bd984b4
Instruction Fuzzy Hash: 04714C31644215BEEB21CF69DD89FAABF74FF05324F208216F6246A1E0C7B1AD50D750

Function 00A76CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00A76DEB

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00A76E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00A76E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A76E94
DestroyWindow.USER32(?), ref: 00A76EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,009E0000,00000000), ref: 00A76EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A76EFD
GetDesktopWindow.USER32 ref: 00A76F16
GetWindowRect.USER32(00000000), ref: 00A76F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00A76F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00A76F4D

Part of subcall function 009F9944: GetWindowLongW.USER32(?,000000EB), ref: 009F9952

Strings

tooltips_class32, xrefs: 00A76E58, 00A76EDD
0, xrefs: 00A76D98

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 2fd60df491f18b2a9ce0b491745e4cc21aee417c795df5323baa8a83cc44f2dc
Instruction ID: b45f123d66797f719982823cdac3019b602fad464bb75dd3aaad288d534440d4
Opcode Fuzzy Hash: 2fd60df491f18b2a9ce0b491745e4cc21aee417c795df5323baa8a83cc44f2dc
Instruction Fuzzy Hash: 7C718970104640AFDB21DF68DC54FAABBF9FB89304F54852DF98987262C774E94ACB11

Function 00A7911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

DragQueryPoint.SHELL32(?,?), ref: 00A79147

Part of subcall function 00A77674: ClientToScreen.USER32(?,?), ref: 00A7769A
Part of subcall function 00A77674: GetWindowRect.USER32(?,?), ref: 00A77710
Part of subcall function 00A77674: PtInRect.USER32(?,?,00A78B89), ref: 00A77720

SendMessageW.USER32(?,000000B0,?,?), ref: 00A791B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00A791BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00A791DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00A79225
SendMessageW.USER32(?,000000B0,?,?), ref: 00A7923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00A79255
SendMessageW.USER32(?,000000B1,?,?), ref: 00A79277
DragFinish.SHELL32(?), ref: 00A7927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00A79371

Strings

@GUI_DRAGID, xrefs: 00A792E9
@GUI_DRAGFILE, xrefs: 00A79320
@GUI_DROPID, xrefs: 00A7929E

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: f00c9fdaaca2e2303e04c5752041a0eb587ce6e422024626d57e9f7f0b5dcc17
Instruction ID: 907b2aa57eccb12a059d3736a326e9c4476154f30f535fb1ff8cee7a16112510
Opcode Fuzzy Hash: f00c9fdaaca2e2303e04c5752041a0eb587ce6e422024626d57e9f7f0b5dcc17
Instruction Fuzzy Hash: 7B616B71108341AFC701EFA5DC85EAFBBE8EFC9750F40891EF599921A1DB309A49CB52

Function 00A5C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A5C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00A5C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00A5C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00A5C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00A5C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00A5C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A5C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00A5C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00A5C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00A5C5F0
InternetCloseHandle.WININET(00000000), ref: 00A5C5FB

Strings

, xrefs: 00A5C575

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: fbbf16e276d3bdbb37d24b18d3bc0476b24f2c33946b3df6758b7a58d35d21bb
Instruction ID: 043a5add842b58b53103d5ef8c3799adb3d53fdde8239315618256fadb35abd7
Opcode Fuzzy Hash: fbbf16e276d3bdbb37d24b18d3bc0476b24f2c33946b3df6758b7a58d35d21bb
Instruction Fuzzy Hash: 50513DB1540304BFDB21DFA4CD88AAB7BBCFB08765F00841DF94696255EB34EA49DB60

Function 00A7856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00A78592
GetFileSize.KERNEL32(00000000,00000000), ref: 00A785A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00A785AD
CloseHandle.KERNEL32(00000000), ref: 00A785BA
GlobalLock.KERNEL32(00000000), ref: 00A785C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00A785D7
GlobalUnlock.KERNEL32(00000000), ref: 00A785E0
CloseHandle.KERNEL32(00000000), ref: 00A785E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00A785F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,00A7FC38,?), ref: 00A78611
GlobalFree.KERNEL32(00000000), ref: 00A78621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00A78641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00A78671
DeleteObject.GDI32(00000000), ref: 00A78699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00A786AF

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 2229170d9d6df912015f21bd208a02ad65aa808618995ab52d71b5e5bb1e2066
Instruction ID: c474742ecc14f59dfe16a753ed41821752efd0333186e7d0b60de589e968d430
Opcode Fuzzy Hash: 2229170d9d6df912015f21bd208a02ad65aa808618995ab52d71b5e5bb1e2066
Instruction Fuzzy Hash: 39410875640205BFDB11DFA5CC8CEAA7BB8EF89B21F10C158F909E7260DB349942CB60

Function 00A514BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00A51502
VariantCopy.OLEAUT32(?,?), ref: 00A5150B
VariantClear.OLEAUT32(?), ref: 00A51517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00A515FB
VarR8FromDec.OLEAUT32(?,?), ref: 00A51657
VariantInit.OLEAUT32(?), ref: 00A51708
SysFreeString.OLEAUT32(?), ref: 00A5178C
VariantClear.OLEAUT32(?), ref: 00A517D8
VariantClear.OLEAUT32(?), ref: 00A517E7
VariantInit.OLEAUT32(00000000), ref: 00A51823

Strings

Default, xrefs: 00A516AF
%4d%02d%02d%02d%02d%02d, xrefs: 00A51625

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 9c59414970eb2c7d918fb751c3396b2133ed51596a215c600793ba5a01188c10
Instruction ID: e6b7543b6ef9d9ff9e69082bce9feb15b7482a479a92b96cd6be96b1fc9c9755
Opcode Fuzzy Hash: 9c59414970eb2c7d918fb751c3396b2133ed51596a215c600793ba5a01188c10
Instruction Fuzzy Hash: D8D12471A00115EBDB10EF65E889B7DB7B5BF84702F10845AFC4AAB190EB34EC49DB61

Function 00A6B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A6C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A6B6AE,?,?), ref: 00A6C9B5
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6C9F1
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA68
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A6B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A6B772
RegDeleteValueW.ADVAPI32(?,?), ref: 00A6B80A
RegCloseKey.ADVAPI32(?), ref: 00A6B87E
RegCloseKey.ADVAPI32(?), ref: 00A6B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00A6B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00A6B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00A6B922
FreeLibrary.KERNEL32(00000000), ref: 00A6B983
RegCloseKey.ADVAPI32(00000000), ref: 00A6B994

Strings

RegDeleteKeyExW, xrefs: 00A6B8FE
advapi32.dll, xrefs: 00A6B8ED

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: f995d50c06d4a4c5ed3fd78b64280bc023cb743058dd5744188c68944fb115ae
Instruction ID: ba9ab70f0daad3da52cb2649b649dedecf48484487a3d642774bc186389efd31
Opcode Fuzzy Hash: f995d50c06d4a4c5ed3fd78b64280bc023cb743058dd5744188c68944fb115ae
Instruction Fuzzy Hash: BDC18D31214241AFD715DF25C494F2ABBF5BF84318F14855CF59A8B2A2CB35EC86CBA1

Function 00A6255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A625D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00A625E8
CreateCompatibleDC.GDI32(?), ref: 00A625F4
SelectObject.GDI32(00000000,?), ref: 00A62601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00A6266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00A626AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00A626D0
SelectObject.GDI32(?,?), ref: 00A626D8
DeleteObject.GDI32(?), ref: 00A626E1
DeleteDC.GDI32(?), ref: 00A626E8
ReleaseDC.USER32(00000000,?), ref: 00A626F3

Strings

(, xrefs: 00A6268D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 7bd185f8c5e7812a9736d8ce1f8057f7bcc7ec920c192c30b39bb160e7486662
Instruction ID: 03944d672638f27c954670658e2b3714472b4f222e921f3be70d75945420b46e
Opcode Fuzzy Hash: 7bd185f8c5e7812a9736d8ce1f8057f7bcc7ec920c192c30b39bb160e7486662
Instruction Fuzzy Hash: D761D275D00219EFCF14CFE4DD84AAEBBB5FF48310F208529E959A7250E774A9418F90

Function 00A1DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00A1DAA1

Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D659
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D66B
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D67D
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D68F
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D6A1
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D6B3
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D6C5
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D6D7
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D6E9
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D6FB
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D70D
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D71F
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D731

_free.LIBCMT ref: 00A1DA96

Part of subcall function 00A129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000), ref: 00A129DE
Part of subcall function 00A129C8: GetLastError.KERNEL32(00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000,00000000), ref: 00A129F0

_free.LIBCMT ref: 00A1DAB8
_free.LIBCMT ref: 00A1DACD
_free.LIBCMT ref: 00A1DAD8
_free.LIBCMT ref: 00A1DAFA
_free.LIBCMT ref: 00A1DB0D
_free.LIBCMT ref: 00A1DB1B
_free.LIBCMT ref: 00A1DB26
_free.LIBCMT ref: 00A1DB5E
_free.LIBCMT ref: 00A1DB65
_free.LIBCMT ref: 00A1DB82
_free.LIBCMT ref: 00A1DB9A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b1606d8e3a2a8fb64496b5e104278af51ee712b99a6cbe171b63d941b87982d5
Instruction ID: 974d4a0c374f4c151ad89a9bca9bac0d5a9bac39d90af95d9d7612f60fb4a29a
Opcode Fuzzy Hash: b1606d8e3a2a8fb64496b5e104278af51ee712b99a6cbe171b63d941b87982d5
Instruction Fuzzy Hash: 84314B326087059FEB21AB39E945BDA77E9FF403A0F154419E449DB191DF35ECE08720

Function 00A4365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00A4369C
_wcslen.LIBCMT ref: 00A436A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00A43797
GetClassNameW.USER32(?,?,00000400), ref: 00A4380C
GetDlgCtrlID.USER32(?), ref: 00A4385D
GetWindowRect.USER32(?,?), ref: 00A43882
GetParent.USER32(?), ref: 00A438A0
ScreenToClient.USER32(00000000), ref: 00A438A7
GetClassNameW.USER32(?,?,00000100), ref: 00A43921
GetWindowTextW.USER32(?,?,00000400), ref: 00A4395D

Strings

%s%u, xrefs: 00A43734

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 0517e05e8bf7ac446dfe22278839180dca463d6dd40980d7478afeed03b23d55
Instruction ID: 100f56d50ed4d3abad26b67e84602a3bb14b0453a96e3f852b3c49552ff3e480
Opcode Fuzzy Hash: 0517e05e8bf7ac446dfe22278839180dca463d6dd40980d7478afeed03b23d55
Instruction Fuzzy Hash: 4191F276204206AFDB18DF64C895FEAF7E8FF84350F108529F999C2191DB30EA46CB91

Function 00A44954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00A44994
GetWindowTextW.USER32(?,?,00000400), ref: 00A449DA
_wcslen.LIBCMT ref: 00A449EB
CharUpperBuffW.USER32(?,00000000), ref: 00A449F7
_wcsstr.LIBVCRUNTIME ref: 00A44A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00A44A64
GetWindowTextW.USER32(?,?,00000400), ref: 00A44A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00A44AE6
GetClassNameW.USER32(?,?,00000400), ref: 00A44B20
GetWindowRect.USER32(?,?), ref: 00A44B8B

Strings

ThumbnailClass, xrefs: 00A44A6F, 00A44AF1

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: e5b7174f732f0ff121ea31959d9e58193d364f00b6d0046a1ba361f7b5d40818
Instruction ID: 5c2aee69220ca35bb4ffa4d12517ef51227d2cb6bd8a8ee8ae4f5f75c25015a6
Opcode Fuzzy Hash: e5b7174f732f0ff121ea31959d9e58193d364f00b6d0046a1ba361f7b5d40818
Instruction Fuzzy Hash: 5191CE751042099FDB04DF14C985BAB7BE8FFC8754F048469FD899A096EB30ED46CBA1

Function 00A4BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00AB1990,000000FF,00000000,00000030), ref: 00A4BFAC
SetMenuItemInfoW.USER32(00AB1990,00000004,00000000,00000030), ref: 00A4BFE1
Sleep.KERNEL32(000001F4), ref: 00A4BFF3
GetMenuItemCount.USER32(?), ref: 00A4C039
GetMenuItemID.USER32(?,00000000), ref: 00A4C056
GetMenuItemID.USER32(?,-00000001), ref: 00A4C082
GetMenuItemID.USER32(?,?), ref: 00A4C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A4C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A4C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A4C145

Strings

0, xrefs: 00A4BF3D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: a1cd222506bf32ef708b3844977e7efcdc9f095822f635d01d5c052d58d86048
Instruction ID: 6a3a8cf8bcefad3870a4b2a2814102e4da7bd7880f496f5bad7ba65588854857
Opcode Fuzzy Hash: a1cd222506bf32ef708b3844977e7efcdc9f095822f635d01d5c052d58d86048
Instruction Fuzzy Hash: A661C17490124AEFDF11CFA8CD88AEE7BB8EB85364F104159E809A3292D731ED45CB60

Function 00A6CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00A6CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00A6CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00A6CD48

Part of subcall function 00A6CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00A6CCAA
Part of subcall function 00A6CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00A6CCBD
Part of subcall function 00A6CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00A6CCCF
Part of subcall function 00A6CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00A6CD05
Part of subcall function 00A6CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00A6CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00A6CCF3

Strings

RegDeleteKeyExW, xrefs: 00A6CCC9
advapi32.dll, xrefs: 00A6CCB8

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 4c301a1ecfd3e25a818abd800c3a263f3ebe9df59a790baf0ef79b8d53cddf95
Instruction ID: 67b282c67bfbc4392fcda63abacbe3f117991cfe7debea9ab95c26ce6160bc66
Opcode Fuzzy Hash: 4c301a1ecfd3e25a818abd800c3a263f3ebe9df59a790baf0ef79b8d53cddf95
Instruction Fuzzy Hash: CE316071901129BBD721DB94DC88EFFBB7CEF45760F004169A949E3140D7349A86DAE0

Function 00A53D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00A53D40
_wcslen.LIBCMT ref: 00A53D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00A53D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00A53DBE
RemoveDirectoryW.KERNEL32(?), ref: 00A53DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00A53E55
CloseHandle.KERNEL32(00000000), ref: 00A53E60
CloseHandle.KERNEL32(00000000), ref: 00A53E6B

Strings

\, xrefs: 00A53D77
:, xrefs: 00A53D82
\??\%s, xrefs: 00A53D5B

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: b342158f60f4bc201f47fbb98d9bb3cf31478a769dcb3af15d58a0e24aad08c7
Instruction ID: 959ac02fdb8ac8e2455b2e77e7bddd58d26854541b71511eb7fcf0f5d9302f8d
Opcode Fuzzy Hash: b342158f60f4bc201f47fbb98d9bb3cf31478a769dcb3af15d58a0e24aad08c7
Instruction Fuzzy Hash: A0319273900209AADB21DBA0DC49FEB37BCFF88751F1045B9FA09D6061E77097898B64

Function 00A4E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00A4E6B4

Part of subcall function 009FE551: timeGetTime.WINMM(?,?,00A4E6D4), ref: 009FE555

Sleep.KERNEL32(0000000A), ref: 00A4E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00A4E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00A4E727
SetActiveWindow.USER32 ref: 00A4E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00A4E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00A4E773
Sleep.KERNEL32(000000FA), ref: 00A4E77E
IsWindow.USER32 ref: 00A4E78A
EndDialog.USER32(00000000), ref: 00A4E79B

Strings

BUTTON, xrefs: 00A4E719

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: f6237ba26ebe929193965064e0116a3b6bbb5e86ca2337703fdae94789592fb4
Instruction ID: 47cafde6f2a6449d82f402ab47dba886857aff510b7b4f45dc2e1deda06a09b6
Opcode Fuzzy Hash: f6237ba26ebe929193965064e0116a3b6bbb5e86ca2337703fdae94789592fb4
Instruction Fuzzy Hash: 3221C674600204AFEB00DFE0ECDAF253B69F7943A9F106539F505C21B2DB719C429B14

Function 00A4E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00A4EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00A4EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A4EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00A4EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00A4EAA7

Strings

open , xrefs: 00A4EA0C
close PlayMe, xrefs: 00A4EA6E, 00A4EA9B
play PlayMe, xrefs: 00A4EAA2
alias PlayMe, xrefs: 00A4EA36
play PlayMe wait, xrefs: 00A4EA91
status PlayMe mode, xrefs: 00A4EA58

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: b59de1d53308d5e4ed7c90808c12b51e09bae0173c3a10a1e062eb555d8d8ea2
Instruction ID: 544c27084cd2e46715386a7fb2e8b9f9013d9174fcd9ed5f9af3bc3915e84120
Opcode Fuzzy Hash: b59de1d53308d5e4ed7c90808c12b51e09bae0173c3a10a1e062eb555d8d8ea2
Instruction Fuzzy Hash: F2111C35A9025979D721E7A2DC4AEFB6B7CFBD2B40F444829B811A30D1EBB05D45C9B0

Function 00A49F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00A4A012
SetKeyboardState.USER32(?), ref: 00A4A07D
GetAsyncKeyState.USER32(000000A0), ref: 00A4A09D
GetKeyState.USER32(000000A0), ref: 00A4A0B4
GetAsyncKeyState.USER32(000000A1), ref: 00A4A0E3
GetKeyState.USER32(000000A1), ref: 00A4A0F4
GetAsyncKeyState.USER32(00000011), ref: 00A4A120
GetKeyState.USER32(00000011), ref: 00A4A12E
GetAsyncKeyState.USER32(00000012), ref: 00A4A157
GetKeyState.USER32(00000012), ref: 00A4A165
GetAsyncKeyState.USER32(0000005B), ref: 00A4A18E
GetKeyState.USER32(0000005B), ref: 00A4A19C

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 7bfc847ba571237014a5052bad6f2980112f20b71e4aee7a7cbad88882a78212
Instruction ID: 35d395eaee6ebec70d9f686813a46a185812abfb54aee4443c2f8afebff4c5ca
Opcode Fuzzy Hash: 7bfc847ba571237014a5052bad6f2980112f20b71e4aee7a7cbad88882a78212
Instruction Fuzzy Hash: 96511D3854478429FB35DBB489107EBBFF59FA1380F08858DD5C2571C2DA549E8CC762

Function 00A45CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00A45CE2
GetWindowRect.USER32(00000000,?), ref: 00A45CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00A45D59
GetDlgItem.USER32(?,00000002), ref: 00A45D69
GetWindowRect.USER32(00000000,?), ref: 00A45D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00A45DCF
GetDlgItem.USER32(?,000003E9), ref: 00A45DDD
GetWindowRect.USER32(00000000,?), ref: 00A45DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00A45E31
GetDlgItem.USER32(?,000003EA), ref: 00A45E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00A45E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00A45E67

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 8a94ebcd74636034f318a66e558ee9219f88173d17f681e09d59bafe15d96483
Instruction ID: 829f5832c2863692a9665854f76e1277d891f7dac01ab2623f891bfe0d779866
Opcode Fuzzy Hash: 8a94ebcd74636034f318a66e558ee9219f88173d17f681e09d59bafe15d96483
Instruction Fuzzy Hash: 32512D74E00605AFDF18CFA8CD89AAEBBB5FF88310F148129F519E6291D7709E41CB50

Function 009F8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 009F8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009F8BE8,?,00000000,?,?,?,?,009F8BBA,00000000,?), ref: 009F8FC5

DestroyWindow.USER32(?), ref: 009F8C81
KillTimer.USER32(00000000,?,?,?,?,009F8BBA,00000000,?), ref: 009F8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00A36973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,009F8BBA,00000000,?), ref: 00A369A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,009F8BBA,00000000,?), ref: 00A369B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,009F8BBA,00000000), ref: 00A369D4
DeleteObject.GDI32(00000000), ref: 00A369E6

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 11c1d24f3c699a33fed3559d2398639d1077e849a3eb8e8ddcf46cf367c42f90
Instruction ID: f3da752e60e20bef8e4fc5c7c019f3eaa950e7d5783f53902cc0c16bd238d262
Opcode Fuzzy Hash: 11c1d24f3c699a33fed3559d2398639d1077e849a3eb8e8ddcf46cf367c42f90
Instruction Fuzzy Hash: EE61AA31502608EFCB65DF64DD58B3677F1FB40322F548A1CE2869B9B0CB35A992DB90

Function 009F9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 009F9944: GetWindowLongW.USER32(?,000000EB), ref: 009F9952

GetSysColor.USER32(0000000F), ref: 009F9862

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: e13a0aefa7f7d084c6c5be45827c390c85cdd0311401726c8ef4f45c268b4a00
Instruction ID: f93c52bd1f700f77c061a59f38fddbd3805ec5e207953ad306f2e3eb2092edc0
Opcode Fuzzy Hash: e13a0aefa7f7d084c6c5be45827c390c85cdd0311401726c8ef4f45c268b4a00
Instruction Fuzzy Hash: CB41D531104648AFDB309F789C88BB93BA9FB46370F548619FAA6871E1D7719D82DB10

Function 00A496E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00A2F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00A49717
LoadStringW.USER32(00000000,?,00A2F7F8,00000001), ref: 00A49720

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00A2F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00A49742
LoadStringW.USER32(00000000,?,00A2F7F8,00000001), ref: 00A49745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00A49866

Strings

Line %d:, xrefs: 00A497A0
^ ERROR, xrefs: 00A497FB
Line %d (File "%s"):, xrefs: 00A4978F
Error: , xrefs: 00A4981D
%s (%d) : ==> %s: %s %s, xrefs: 00A4984A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 997647c725e8f1a49f519a66aa1f0658330416ccafcdbab50609f63077482b8a
Instruction ID: a7828ec831a8f5ee5c5899d85edcf493e08ba89f146e06a4059f694b272f21d0
Opcode Fuzzy Hash: 997647c725e8f1a49f519a66aa1f0658330416ccafcdbab50609f63077482b8a
Instruction Fuzzy Hash: 71415D72800249AACF15EBE1DE86EEF7778AF95340F604425B605720A2EB356F49CB61

Function 00A406DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00A407A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00A407BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00A407DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00A40804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00A4082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A40837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A4083C

Strings

SOFTWARE\Classes\, xrefs: 00A4070E
\CLSID, xrefs: 00A40724
\IPC$, xrefs: 00A40784

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: e5697a8d08daada00c2be721b0c365d7373d4c5f7be7400b2607c5745f7df88b
Instruction ID: 428bc075b558e5c135dc31e5617a7c345f76edadbf476f33c447f26b7072897e
Opcode Fuzzy Hash: e5697a8d08daada00c2be721b0c365d7373d4c5f7be7400b2607c5745f7df88b
Instruction Fuzzy Hash: 14412A76C10229ABCF15EFA4DC85DEEB778FF84350F544129E905A71A1EB30AE45CBA0

Function 00A73F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00A7403B
CreateCompatibleDC.GDI32(00000000), ref: 00A74042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00A74055
SelectObject.GDI32(00000000,00000000), ref: 00A7405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00A74068
DeleteDC.GDI32(00000000), ref: 00A74072
GetWindowLongW.USER32(?,000000EC), ref: 00A7407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00A74092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00A7409E

Strings

static, xrefs: 00A73FD3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: a37a0d3eff60d48fce47b8f27e9d5e428e3b6b382f5ab5d7a0ea4f93c6c3a0e0
Instruction ID: 7c5762ee5307725408dfb068b7ad096f794e0704e6265d72408941a82a735ac1
Opcode Fuzzy Hash: a37a0d3eff60d48fce47b8f27e9d5e428e3b6b382f5ab5d7a0ea4f93c6c3a0e0
Instruction Fuzzy Hash: 28318C32101215BBDF229FA4CC48FDA3B68FF0D721F118214FA18E60A0C739D852DB94

Function 00A63C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A63C5C
CoInitialize.OLE32(00000000), ref: 00A63C8A
CoUninitialize.OLE32 ref: 00A63C94
_wcslen.LIBCMT ref: 00A63D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00A63DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00A63ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00A63F0E
CoGetObject.OLE32(?,00000000,00A7FB98,?), ref: 00A63F2D
SetErrorMode.KERNEL32(00000000), ref: 00A63F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A63FC4
VariantClear.OLEAUT32(?), ref: 00A63FD8

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: d8045e23f0d55e40d2e17245ba25cd0d5e551c0a9fd75cb5b94d68a56cbd60a5
Instruction ID: 1ed422c5168fbaf92dc53431bdfc159da67357c7231f89c8f47002143efa41d9
Opcode Fuzzy Hash: d8045e23f0d55e40d2e17245ba25cd0d5e551c0a9fd75cb5b94d68a56cbd60a5
Instruction Fuzzy Hash: 88C13472608205AFDB00DF68C88492BB7F9FF89754F10491DF98A9B251DB31EE46CB52

Function 00A57A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A57AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00A57B8F
SHGetDesktopFolder.SHELL32(?), ref: 00A57BA3
CoCreateInstance.OLE32(00A7FD08,00000000,00000001,00AA6E6C,?), ref: 00A57BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00A57C74
CoTaskMemFree.OLE32(?,?), ref: 00A57CCC
SHBrowseForFolderW.SHELL32(?), ref: 00A57D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00A57D7A
CoTaskMemFree.OLE32(00000000), ref: 00A57D81
CoTaskMemFree.OLE32(00000000), ref: 00A57DD6
CoUninitialize.OLE32 ref: 00A57DDC

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 297d368f80a40e6550decdc2ee80465ad3d8eadb6b59ee893c1c1d8d042c8bb0
Instruction ID: 85b21e1c026b058cc72f349d5052106fa2d3e6c7d49a9ef922b8d6892b95fbe5
Opcode Fuzzy Hash: 297d368f80a40e6550decdc2ee80465ad3d8eadb6b59ee893c1c1d8d042c8bb0
Instruction Fuzzy Hash: 5EC11C75A04109AFCB14DFA4D884DAEBBF9FF48315B148499F81AAB261DB30ED45CF90

Function 00A7541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00A75504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A75515
CharNextW.USER32(00000158), ref: 00A75544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00A75585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00A7559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A755AC

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: d5d13ac424074fa256a563521b73c8ab5dfecbf414a941e07b1ab425a9291d53
Instruction ID: 4e8045dde4806d1474f4e79720d4f1d7a2b662657316645168a400e2ccef09a4
Opcode Fuzzy Hash: d5d13ac424074fa256a563521b73c8ab5dfecbf414a941e07b1ab425a9291d53
Instruction Fuzzy Hash: C3618071D00608EFDF10DFA4CC84AFE7BB9EB05761F10C149F629A6291D7B49A81DB60

Function 00A3FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00A3FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00A3FB08
VariantInit.OLEAUT32(?), ref: 00A3FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00A3FB3A
VariantCopy.OLEAUT32(?,?), ref: 00A3FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00A3FBA1
VariantClear.OLEAUT32(?), ref: 00A3FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00A3FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A3FBCC
VariantClear.OLEAUT32(?), ref: 00A3FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A3FBE9

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 4f6769b07ad157c3487f92ea3750bdc9c605c8d6844fcf698ba027c7087eefc9
Instruction ID: 161c65306999d0a069840c20a6e314ab02315e18f3d98f29980bf1bc8a37d3ea
Opcode Fuzzy Hash: 4f6769b07ad157c3487f92ea3750bdc9c605c8d6844fcf698ba027c7087eefc9
Instruction Fuzzy Hash: 23414275E102199FCB00DFA8DC589AEBBB9FF48354F008069F956A7261D730AA46CF90

Function 00A49C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00A49CA1
GetAsyncKeyState.USER32(000000A0), ref: 00A49D22
GetKeyState.USER32(000000A0), ref: 00A49D3D
GetAsyncKeyState.USER32(000000A1), ref: 00A49D57
GetKeyState.USER32(000000A1), ref: 00A49D6C
GetAsyncKeyState.USER32(00000011), ref: 00A49D84
GetKeyState.USER32(00000011), ref: 00A49D96
GetAsyncKeyState.USER32(00000012), ref: 00A49DAE
GetKeyState.USER32(00000012), ref: 00A49DC0
GetAsyncKeyState.USER32(0000005B), ref: 00A49DD8
GetKeyState.USER32(0000005B), ref: 00A49DEA

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: e3c1a407d3d659e80c5508748466b17b812bf3776daa209eca201e1c4bf9d329
Instruction ID: 4aa6449ad436891a2999323b564dc0ad5e2a199df216ce16e473f0dd3890caa6
Opcode Fuzzy Hash: e3c1a407d3d659e80c5508748466b17b812bf3776daa209eca201e1c4bf9d329
Instruction Fuzzy Hash: AD41F8389047C96DFF30CB6088447B7BEA06F91354F04805EDAC6565C2DBA599E8C7A2

Function 00A6055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00A605BC
inet_addr.WSOCK32(?), ref: 00A6061C
gethostbyname.WSOCK32(?), ref: 00A60628
IcmpCreateFile.IPHLPAPI ref: 00A60636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00A606C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00A606E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00A607B9
WSACleanup.WSOCK32 ref: 00A607BF

Strings

Ping, xrefs: 00A60676

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 71bb8aeb7656944bd70985202d7631a84589a0876a3e33426cdb6014a4ed78d6
Instruction ID: 3e03e4cb80af9fa41b6adb76c68404940334bf55e40099debcab7d2ba1bfd60e
Opcode Fuzzy Hash: 71bb8aeb7656944bd70985202d7631a84589a0876a3e33426cdb6014a4ed78d6
Instruction Fuzzy Hash: A7919D756046419FD320CF15D888F1BBBF0AF84318F1485A9F4AA8B6A2CB70ED85CF91

Function 00A68CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00A68CF3

Part of subcall function 00A48E54: _wcslen.LIBCMT ref: 00A48E77

_wcslen.LIBCMT ref: 00A68D4E
_wcslen.LIBCMT ref: 00A68D9C
_wcslen.LIBCMT ref: 00A68DDC
_wcslen.LIBCMT ref: 00A68E6E

Strings

winapi, xrefs: 00A68D96, 00A68D9B
stdcall, xrefs: 00A68DD6, 00A68DDB
cdecl, xrefs: 00A68D48, 00A68D4D
none, xrefs: 00A68E65, 00A68E6A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 6e829624ca566f3f3ca3f0634c943fc7baaefab78d943993e5a5e6d3a9c90d87
Instruction ID: f4a0194ce7ee44dc3d7b95739c6de8b7e890598476035d06b06930e734a0cf99
Opcode Fuzzy Hash: 6e829624ca566f3f3ca3f0634c943fc7baaefab78d943993e5a5e6d3a9c90d87
Instruction Fuzzy Hash: 2E51B271A001169BCF24DF6CC9509BEB7B9BF65764B204329E926E72C4DB39DD40C790

Function 00A6372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00A63774
CoUninitialize.OLE32 ref: 00A6377F
CoCreateInstance.OLE32(?,00000000,00000017,00A7FB78,?), ref: 00A637D9
IIDFromString.OLE32(?,?), ref: 00A6384C
VariantInit.OLEAUT32(?), ref: 00A638E4
VariantClear.OLEAUT32(?), ref: 00A63936

Strings

NULL Pointer assignment, xrefs: 00A6381E
Failed to create object, xrefs: 00A637E4, 00A6389A
Invalid parameter, xrefs: 00A63865

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 26a78db54bb7c551d47bb61cc614f979cc680b406dd0664c4f5900257b751af8
Instruction ID: dbd74e508b8a13c79b1d401a04cc986d097032b6ca9ef59fe9ff011c035ac919
Opcode Fuzzy Hash: 26a78db54bb7c551d47bb61cc614f979cc680b406dd0664c4f5900257b751af8
Instruction Fuzzy Hash: F1618E72608311AFD711DF54C889BAABBF4EF89710F10481DF9859B291D770EE4ACB92

Function 00A53388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00A533CF

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00A533F0

Strings

^ ERROR , xrefs: 00A5349E
"%s" (%d) : ==> %s:, xrefs: 00A53522
Line %d (File "%s"):, xrefs: 00A53443, 00A5345C
Error: , xrefs: 00A534D1
"%s" (%d) : ==> %s:%s%s, xrefs: 00A53504
Incorrect parameters to object property !, xrefs: 00A534AB

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: d2d9d5f0f93328c6c5aee427d32670c76cfb244371ce62078b42ad7f89f6ee17
Instruction ID: 391109de315d9c80be03173e115820fb77a9e2ff7282fda842f1d7dd2d21c46a
Opcode Fuzzy Hash: d2d9d5f0f93328c6c5aee427d32670c76cfb244371ce62078b42ad7f89f6ee17
Instruction Fuzzy Hash: 39519F32900149BADF16EBE0CD46EEEB7B8BF94340F648565B505720A2EB312F58CB60

Function 00A4B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A4B5FC
_wcslen.LIBCMT ref: 00A4B608
_wcslen.LIBCMT ref: 00A4B64D
_wcslen.LIBCMT ref: 00A4B68C
_wcslen.LIBCMT ref: 00A4B6C7

Strings

EXISTS, xrefs: 00A4B686, 00A4B68B
REMOVE, xrefs: 00A4B602, 00A4B607
APPEND, xrefs: 00A4B6C1, 00A4B6C6
KEYS, xrefs: 00A4B647, 00A4B64C

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: d78d0fb8ccd3a0a690f88110b1294f0b66dcb5a10b55afe457d36522f2148164
Instruction ID: e79bac26af3064208a5b9c67861d2fcb38a436152e4010c648d9cef012ddb678
Opcode Fuzzy Hash: d78d0fb8ccd3a0a690f88110b1294f0b66dcb5a10b55afe457d36522f2148164
Instruction Fuzzy Hash: BB410636A210269BCB209F7DCD905BEF7B5BFE1794B264529E821D7284E731CD81C7A0

Function 00A55393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A553A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00A55416
GetLastError.KERNEL32 ref: 00A55420
SetErrorMode.KERNEL32(00000000,READY), ref: 00A554A7

Strings

UNKNOWN, xrefs: 00A55444
READONLY, xrefs: 00A55452
NOTREADY, xrefs: 00A5544B
INVALID, xrefs: 00A55459
READY, xrefs: 00A55460, 00A55468

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: ba694767d09dd33d74759c60abfc60f41d9263fbcaed75d3ed528e8537a44461
Instruction ID: 07785927cbd25c844b4aec975a75215d45395b35f1edbc0938ce824ea9a6d2d2
Opcode Fuzzy Hash: ba694767d09dd33d74759c60abfc60f41d9263fbcaed75d3ed528e8537a44461
Instruction Fuzzy Hash: D931B035E006049FD711DF78C894BAABBB5FF55306F188069E805CB292DB31DD8ACB90

Function 00A73C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00A73C79
SetMenu.USER32(?,00000000), ref: 00A73C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A73D10
IsMenu.USER32(?), ref: 00A73D24
CreatePopupMenu.USER32 ref: 00A73D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A73D5B
DrawMenuBar.USER32 ref: 00A73D63

Strings

0, xrefs: 00A73C54
F, xrefs: 00A73D4E

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: b4fe1f32f6c6f9df27235a85a4b65830b5c7b838b5802ae3d185b9ce8e63ffec
Instruction ID: d3a1cc2f6adde3151a1918f99c3fb4a8b8197ae26c9f869037da392e2ecee228
Opcode Fuzzy Hash: b4fe1f32f6c6f9df27235a85a4b65830b5c7b838b5802ae3d185b9ce8e63ffec
Instruction Fuzzy Hash: C6419876A01209AFDF24CFA0DC44AAA7BB5FF49310F05842CE90AA7361D771AA11DB90

Function 00A41EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A43CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00A41F64
GetDlgCtrlID.USER32 ref: 00A41F6F
GetParent.USER32 ref: 00A41F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A41F8E
GetDlgCtrlID.USER32(?), ref: 00A41F97
GetParent.USER32(?), ref: 00A41FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A41FAE

Strings

ComboBox, xrefs: 00A41EEC
ListBox, xrefs: 00A41F21

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: f4bbb4ceb1fa5734408aab09197974ab2f429ccbbbd4239f4ac0dbfdfbf092b6
Instruction ID: 95d59a40951883e4732e8e4ea34bae13216fd8f7c8d55925b141eba8dccaf9f4
Opcode Fuzzy Hash: f4bbb4ceb1fa5734408aab09197974ab2f429ccbbbd4239f4ac0dbfdfbf092b6
Instruction Fuzzy Hash: B021F274900214BBCF01EFA0CC84EEEBBB8EF45310B10450AF965632E1DB78494ACB60

Function 00A41FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A43CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00A42043
GetDlgCtrlID.USER32 ref: 00A4204E
GetParent.USER32 ref: 00A4206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A4206D
GetDlgCtrlID.USER32(?), ref: 00A42076
GetParent.USER32(?), ref: 00A4208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00A4208D

Strings

ComboBox, xrefs: 00A41FCD
ListBox, xrefs: 00A42002

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 554b50a9029f3777bc2bbd234d69676b839905ed1bddd81948e606b638cfde3a
Instruction ID: 9c2ad606c652a584939115ebf0d77389f20c8cb4e3fbf9c755a214c91c6440f9
Opcode Fuzzy Hash: 554b50a9029f3777bc2bbd234d69676b839905ed1bddd81948e606b638cfde3a
Instruction Fuzzy Hash: 8621FF75A00204BBCF11EFA0CC85FEEBBB8AF45300F008409B955A31A1DB798D49CB60

Function 00A73A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00A73A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00A73AA0
GetWindowLongW.USER32(?,000000F0), ref: 00A73AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A73AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00A73B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00A73BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00A73BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00A73BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00A73BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00A73C13

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 6a888f32eb7569c045a74b6eb90c4169d5d87c66477a6e15b425875a34b76c0b
Instruction ID: 7951cb7c78eacb96636a2a70f7ca1c02292014920d087dab7a9d57c5b7050d4b
Opcode Fuzzy Hash: 6a888f32eb7569c045a74b6eb90c4169d5d87c66477a6e15b425875a34b76c0b
Instruction Fuzzy Hash: 66618D75900248AFDB11DFA8CD81EEE77B8EB49700F108159FA19E72A1C774AE46DB50

Function 00A4B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A4B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B165
GetWindowThreadProcessId.USER32(00000000), ref: 00A4B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A4B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B21D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 6ea293bb7c6d4ba50d3f52f6c73eb27c19148e05a9bb92593d52acabfa8e734b
Instruction ID: 89a0934fd54b673f8fad6e2268d1a474da9b2f2cb445de33b28ee1a4d8d1df28
Opcode Fuzzy Hash: 6ea293bb7c6d4ba50d3f52f6c73eb27c19148e05a9bb92593d52acabfa8e734b
Instruction Fuzzy Hash: 3831737A550208BFDF10EFA4DC94BAD7BA9BF91321F108219FA05D61A1D7B4DA428F70

Function 00A12C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A12C94

Part of subcall function 00A129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000), ref: 00A129DE
Part of subcall function 00A129C8: GetLastError.KERNEL32(00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000,00000000), ref: 00A129F0

_free.LIBCMT ref: 00A12CA0
_free.LIBCMT ref: 00A12CAB
_free.LIBCMT ref: 00A12CB6
_free.LIBCMT ref: 00A12CC1
_free.LIBCMT ref: 00A12CCC
_free.LIBCMT ref: 00A12CD7
_free.LIBCMT ref: 00A12CE2
_free.LIBCMT ref: 00A12CED
_free.LIBCMT ref: 00A12CFB

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 86ce10463d911ed721ac63a43d4733b10ee4b64385e3fa1cba329c9a4bf4a1f0
Instruction ID: 1f27f14326247a8519de3e0429b53998923f4ac81ef83c1a5916ad483e8fe151
Opcode Fuzzy Hash: 86ce10463d911ed721ac63a43d4733b10ee4b64385e3fa1cba329c9a4bf4a1f0
Instruction Fuzzy Hash: 1C115976510108BFCB02EF58DA42EDD3BA5FF453A0F5145A5FA485F222D631EEB09B90

Function 009E1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 009E1459
OleUninitialize.OLE32(?,00000000), ref: 009E14F8
UnregisterHotKey.USER32(?), ref: 009E16DD
DestroyWindow.USER32(?), ref: 00A224B9
FreeLibrary.KERNEL32(?), ref: 00A2251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A2254B

Strings

close all, xrefs: 009E1454

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: f0f633560101778f9ccb468ec95be6acd8b751c7c605d45dfcfc68e1dde5d78e
Instruction ID: d1a52fd4a2f0916e7fcf168395ababbf9ca126d1bcf10726960b28866370a31e
Opcode Fuzzy Hash: f0f633560101778f9ccb468ec95be6acd8b751c7c605d45dfcfc68e1dde5d78e
Instruction Fuzzy Hash: 2CD1B131701262DFCB2AEF1AD895B29F7A4BF45710F1481ADE54A6B261DB30ED12CF50

Function 00A57DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A57FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00A57FC1
GetFileAttributesW.KERNEL32(?), ref: 00A57FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00A58005
SetCurrentDirectoryW.KERNEL32(?), ref: 00A58017
SetCurrentDirectoryW.KERNEL32(?), ref: 00A58060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00A580B0

Strings

*.*, xrefs: 00A58066

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 46f9393251b0326e3e388c3b020abc8e929f30383b07f9d1e970140064e0379c
Instruction ID: 163ef790b812666e819736d28fb309badc7886f7d50863c6109244fec1cad880
Opcode Fuzzy Hash: 46f9393251b0326e3e388c3b020abc8e929f30383b07f9d1e970140064e0379c
Instruction Fuzzy Hash: A6818F725083459BCB20EF54D845AAEB3E8BB88312F54485EFC85E7251EB34DD49CB52

Function 009E5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 009E5C7A

Part of subcall function 009E5D0A: GetClientRect.USER32(?,?), ref: 009E5D30
Part of subcall function 009E5D0A: GetWindowRect.USER32(?,?), ref: 009E5D71
Part of subcall function 009E5D0A: ScreenToClient.USER32(?,?), ref: 009E5D99

GetDC.USER32 ref: 00A246F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00A24708
SelectObject.GDI32(00000000,00000000), ref: 00A24716
SelectObject.GDI32(00000000,00000000), ref: 00A2472B
ReleaseDC.USER32(?,00000000), ref: 00A24733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00A247C4

Strings

U, xrefs: 00A24693

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 85c06ce9a23c00b48426423fa8b6a85158fdb34a96e7db78745f997c341a3cd9
Instruction ID: afb068c2d2dfe7cbdfb831d216fd27d3ec8705d92f401074b5a8f57a970e2c59
Opcode Fuzzy Hash: 85c06ce9a23c00b48426423fa8b6a85158fdb34a96e7db78745f997c341a3cd9
Instruction Fuzzy Hash: 4C71DF31500245DFCF22CF68DD84ABA3BB6FF4A324F244279E9A55A1A6C7319C82DF50

Function 00A5359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00A535E4

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

LoadStringW.USER32(00AB2390,?,00000FFF,?), ref: 00A5360A

Strings

^ ERROR, xrefs: 00A536C9
"%s" (%d) : ==> %s:, xrefs: 00A53742
Line %d (File "%s"):, xrefs: 00A5366B
Error: , xrefs: 00A536EF
"%s" (%d) : ==> %s:%s%s, xrefs: 00A53724

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 7b739283a222394315e7e33b0b25016bfa583bad441e82588fc577c2792990bb
Instruction ID: 025943d12f5298e4149eecaf39fd4cc4d72facd726529dc518623a274133f52b
Opcode Fuzzy Hash: 7b739283a222394315e7e33b0b25016bfa583bad441e82588fc577c2792990bb
Instruction Fuzzy Hash: 11515A72C00249BADF16EBA1CD46EEEBB78BF94341F544125F505720A2EB305E99DF60

Function 00A5C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A5C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A5C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00A5C2CA
GetLastError.KERNEL32 ref: 00A5C322
SetEvent.KERNEL32(?), ref: 00A5C336
InternetCloseHandle.WININET(00000000), ref: 00A5C341

Strings

, xrefs: 00A5C2BB

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: f0fb489ca72e9c343e9af7d1552af7b378d0ba317a29b7cf65c8cec986e61430
Instruction ID: d4adf1ebe9b723cec3a519319ff17a084289a62a518a7e3b4181518f39dac7e3
Opcode Fuzzy Hash: f0fb489ca72e9c343e9af7d1552af7b378d0ba317a29b7cf65c8cec986e61430
Instruction Fuzzy Hash: 31318DB1500308AFD721DFA49D88AABBAFCFB49766F10851DF84A97205DB30DD498B60

Function 00A4989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00A23AAF,?,?,Bad directive syntax error,00A7CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00A498BC
LoadStringW.USER32(00000000,?,00A23AAF,?), ref: 00A498C3

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00A49987

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 00A498F1
Line %d:, xrefs: 00A49912
., xrefs: 00A4996D
Line %d (File "%s"):, xrefs: 00A4992D
Error: , xrefs: 00A49955

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 9f098890f07a1f04e9bba1eaa1ee0b7136a015bf13a8df34e4834a6da38c6a26
Instruction ID: 128042dbe696c9d3f39fa76dd4702a3ea1b0b0846165fdcd2f7c22a3bf826e18
Opcode Fuzzy Hash: 9f098890f07a1f04e9bba1eaa1ee0b7136a015bf13a8df34e4834a6da38c6a26
Instruction Fuzzy Hash: 25216231840259BBCF16EF90CC0AFEE7775FF58300F448869F519660A2EB719A68DB60

Function 00A4209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00A420AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00A420C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00A4214D

Strings

list, xrefs: 00A4212F
smallicons, xrefs: 00A42115
details, xrefs: 00A420FB
largeicons, xrefs: 00A420E1
SHELLDLL_DefView, xrefs: 00A420CC

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: e5b856394a77627929e5998a4c91be1bfd5201064ab87dd16123ad13c22d9206
Instruction ID: db987bad81252f5eec6a42285d35c941244149b4f869a11db788cf3c7328e3ac
Opcode Fuzzy Hash: e5b856394a77627929e5998a4c91be1bfd5201064ab87dd16123ad13c22d9206
Instruction Fuzzy Hash: 57112C7E784706B9F6017338EC07EE6779CEF49765B60021AF704A50D1FF6558425728

Function 00A18D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2607dc188d6949145af5f386ac39eb24d3b2368344814b1eeebbdf41a4dd8d11
Instruction ID: e64d8d9b024d2ab7046d26d757a0b8b0eccec5634368d1c53f34fc151bdf8579
Opcode Fuzzy Hash: 2607dc188d6949145af5f386ac39eb24d3b2368344814b1eeebbdf41a4dd8d11
Instruction Fuzzy Hash: ADC1D174E04249AFDF21DFA8D851BEEBBB5AF0D310F184199E415AB3D2C7349982CB61

Function 00A1CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00A1CEB7
_free.LIBCMT ref: 00A1CF22
_free.LIBCMT ref: 00A1CF48
_free.LIBCMT ref: 00A1CF71
_free.LIBCMT ref: 00A1CFA9
_free.LIBCMT ref: 00A1CFDA
_free.LIBCMT ref: 00A1D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00A1D09C
_free.LIBCMT ref: 00A1D0B5

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: eee0e1b7d08265f512b53151d8540f14ff971784fa86497fc82d3833fbc1c615
Instruction ID: 46b8c65d158c3783012265820a7f3c619e68188b097347317934fe402cbee8b8
Opcode Fuzzy Hash: eee0e1b7d08265f512b53151d8540f14ff971784fa86497fc82d3833fbc1c615
Instruction Fuzzy Hash: 56612771A44310AFDB21AFF89981BEA7BA5EF05370F04426DF9459B292E6319DC2C790

Function 00A750D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00A75186
ShowWindow.USER32(?,00000000), ref: 00A751C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00A751CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00A751D1

Part of subcall function 00A76FBA: DeleteObject.GDI32(00000000), ref: 00A76FE6

GetWindowLongW.USER32(?,000000F0), ref: 00A7520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A7521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00A7524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00A75287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00A75296

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: d74b01a98ba9b94da0bab03acd346e6e0af13dff109484edc2b5803dfab14731
Instruction ID: 909438c4cea89c6c2c2f6194f794b1d9261666b937e4e9e65c61021d217681d1
Opcode Fuzzy Hash: d74b01a98ba9b94da0bab03acd346e6e0af13dff109484edc2b5803dfab14731
Instruction Fuzzy Hash: 7A518130E40A08BEEF24AF74CC45BD93B65EB05322F54C215FA1D962E1C7B5A990DB80

Function 009F8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00A36890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00A368A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00A368B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00A368D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00A368F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,009F8874,00000000,00000000,00000000,000000FF,00000000), ref: 00A36901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00A3691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,009F8874,00000000,00000000,00000000,000000FF,00000000), ref: 00A3692D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: f6b558d0d0a9a7571f8ea3ec648dfd193b284942990825c719a10857f54bbbd5
Instruction ID: 25306cadbe06421e7d8836d652554b421b485d3f8336fa6baca2876dffa6cdaa
Opcode Fuzzy Hash: f6b558d0d0a9a7571f8ea3ec648dfd193b284942990825c719a10857f54bbbd5
Instruction Fuzzy Hash: D3518770600209EFDB20CF65CC95FBA7BB5FB48761F108A18FA16972A0DB70E991DB50

Function 00A5C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A5C182
GetLastError.KERNEL32 ref: 00A5C195
SetEvent.KERNEL32(?), ref: 00A5C1A9

Part of subcall function 00A5C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A5C272
Part of subcall function 00A5C253: GetLastError.KERNEL32 ref: 00A5C322
Part of subcall function 00A5C253: SetEvent.KERNEL32(?), ref: 00A5C336
Part of subcall function 00A5C253: InternetCloseHandle.WININET(00000000), ref: 00A5C341

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 4c4bc30db67ba81cdc49af84687bb7bee50b26343103daccc354cea553d5cc7a
Instruction ID: 17b40b1aaf9d1c54646922a239eebf27043462d72b23168c2cf51489817d5ed4
Opcode Fuzzy Hash: 4c4bc30db67ba81cdc49af84687bb7bee50b26343103daccc354cea553d5cc7a
Instruction Fuzzy Hash: C431A171100701AFDB21AFE5DD44AAABBF8FF18322F00851DFD5A86615DB30E859DBA0

Function 00A425A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A43A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A43A57
Part of subcall function 00A43A3D: GetCurrentThreadId.KERNEL32 ref: 00A43A5E
Part of subcall function 00A43A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A425B3), ref: 00A43A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00A425BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00A425DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00A425DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A425E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00A42601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00A42605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A4260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00A42623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00A42627

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 6d52ee01d8a11b148c2945003b26475b4f086a2117c3de1ab24377d334b26bb1
Instruction ID: 422bad1d8dae4afa1849d48102c8e0fccf45d296a041d36b310c72e75c1d9e37
Opcode Fuzzy Hash: 6d52ee01d8a11b148c2945003b26475b4f086a2117c3de1ab24377d334b26bb1
Instruction Fuzzy Hash: C501D831390220BBFB10A7A89C8AF593F59DF8EB62F504015F318AE0D1C9E21485CA69

Function 00A41803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00A41449,?,?,00000000), ref: 00A4180C
HeapAlloc.KERNEL32(00000000,?,00A41449,?,?,00000000), ref: 00A41813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00A41449,?,?,00000000), ref: 00A41828
GetCurrentProcess.KERNEL32(?,00000000,?,00A41449,?,?,00000000), ref: 00A41830
DuplicateHandle.KERNEL32(00000000,?,00A41449,?,?,00000000), ref: 00A41833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00A41449,?,?,00000000), ref: 00A41843
GetCurrentProcess.KERNEL32(00A41449,00000000,?,00A41449,?,?,00000000), ref: 00A4184B
DuplicateHandle.KERNEL32(00000000,?,00A41449,?,?,00000000), ref: 00A4184E
CreateThread.KERNEL32(00000000,00000000,00A41874,00000000,00000000,00000000), ref: 00A41868

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 12f37d2e24383aa9418f7f33fb59c75cd1c8ebbb014ae406e4ade5798bc98221
Instruction ID: 7e5bd789c237784e3c5ee415673168d15098f7bd4530e506fd3d3c0072103be6
Opcode Fuzzy Hash: 12f37d2e24383aa9418f7f33fb59c75cd1c8ebbb014ae406e4ade5798bc98221
Instruction Fuzzy Hash: A901BBB5240308BFE710EBA5DC4DF6B7BACEB89B11F408525FA09DB1A1CA709841CB20

Function 00A6A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00A4D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00A4D501
Part of subcall function 00A4D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00A4D50F
Part of subcall function 00A4D4DC: CloseHandle.KERNEL32(00000000), ref: 00A4D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A6A16D
GetLastError.KERNEL32 ref: 00A6A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A6A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00A6A268
GetLastError.KERNEL32(00000000), ref: 00A6A273
CloseHandle.KERNEL32(00000000), ref: 00A6A2C4

Strings

SeDebugPrivilege, xrefs: 00A6A18F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 3a5e26da79f0ccaa4f754b37709a16d4932e053cdf141d61659f65599d2e3271
Instruction ID: 899b38ff02a90a4d940e256eaa3e1a041fc852b258d486cda404c801337c3c92
Opcode Fuzzy Hash: 3a5e26da79f0ccaa4f754b37709a16d4932e053cdf141d61659f65599d2e3271
Instruction Fuzzy Hash: 23618F712042419FD720DF25C894F5ABBE1AFA4318F54849CE46A5B7A3C772EC86CF92

Function 00A73886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00A73925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00A7393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00A73954
_wcslen.LIBCMT ref: 00A73999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00A739C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00A739F4

Strings

SysListView32, xrefs: 00A738F7

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: fc441634ce81e73c4aff3a864d6f39be083792e7449eee42cd095006acb89b8a
Instruction ID: 4b2d58e42d76de166ff35862ad91c9428f4eb1521f80cc5b397471108ac7f451
Opcode Fuzzy Hash: fc441634ce81e73c4aff3a864d6f39be083792e7449eee42cd095006acb89b8a
Instruction Fuzzy Hash: CF418472A00219ABDF219F64CC45BEE77A9FF08350F11852AF958E7281D7759A80DB90

Function 00A4BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A4BCFD
IsMenu.USER32(00000000), ref: 00A4BD1D
CreatePopupMenu.USER32 ref: 00A4BD53
GetMenuItemCount.USER32(013CE9F8), ref: 00A4BDA4
InsertMenuItemW.USER32(013CE9F8,?,00000001,00000030), ref: 00A4BDCC

Strings

2, xrefs: 00A4BD37
0, xrefs: 00A4BCA8

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: e3da1660211adc8bfb5f15941cc49c7d84a2ce78f83bd0c55cd9e145b4d28313
Instruction ID: 42bcd768554596fb3a4cb94b28e11b7bc0b89d011226bdf6155fb6bb8468e965
Opcode Fuzzy Hash: e3da1660211adc8bfb5f15941cc49c7d84a2ce78f83bd0c55cd9e145b4d28313
Instruction Fuzzy Hash: 7751AD78A10209DBDF20CFA8D9C4BAEBBF4AF85324F148199E4159B291D770D945CB71

Function 00A4C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00A4C913

Strings

question, xrefs: 00A4C8CC
warning, xrefs: 00A4C8FC
blank, xrefs: 00A4C895
info, xrefs: 00A4C8B4
stop, xrefs: 00A4C8E4

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 637c780f83ac2b2debefa60431172226524a1c08c0929c653b6b503baa4fdb02
Instruction ID: 5f2e751e8e5ccef9569a6d1e1b44f93a241641414eb56ce65f99dc8e09d6e5dc
Opcode Fuzzy Hash: 637c780f83ac2b2debefa60431172226524a1c08c0929c653b6b503baa4fdb02
Instruction Fuzzy Hash: C311533678A306BAE705AB54DD83CAE37ACEF59374B10002EF508A72C3D7745D405664

Function 00A4DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00A4DE42
gethostname.WSOCK32(?,00000100), ref: 00A4DE5C
gethostbyname.WSOCK32(?), ref: 00A4DE69
inet_ntoa.WSOCK32(?), ref: 00A4DEAB
_strcat.LIBCMT ref: 00A4DEB9
WSACleanup.WSOCK32 ref: 00A4DEDE

Strings

0.0.0.0, xrefs: 00A4DE87

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 1cf5c67908f93df8d85cabde27850bc0d3aa1ccbe2f172b3298d6500b7297c3f
Instruction ID: 373b4f8af7b6005fa4f691bb654458c8a0d4df40c5d47d8ced976ffc914103e1
Opcode Fuzzy Hash: 1cf5c67908f93df8d85cabde27850bc0d3aa1ccbe2f172b3298d6500b7297c3f
Instruction Fuzzy Hash: 32110675904108BFCB24AB60ED4BEEE77BCEF55720F0041ADF509AA0D1EF708A828B50

Function 00A79F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

GetSystemMetrics.USER32(0000000F), ref: 00A79FC7
GetSystemMetrics.USER32(0000000F), ref: 00A79FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00A7A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00A7A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00A7A263
ShowWindow.USER32(00000003,00000000), ref: 00A7A282
InvalidateRect.USER32(?,00000000,00000001), ref: 00A7A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 00A7A2CA

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 61f1d8959166cbf630bd447227ef56b05a130987c9a27bfe9db12640a4f03dd4
Instruction ID: 617e3994709097e49cafefe6df97a859fd5141b03c3018f0df20d08247ae133e
Opcode Fuzzy Hash: 61f1d8959166cbf630bd447227ef56b05a130987c9a27bfe9db12640a4f03dd4
Instruction Fuzzy Hash: EAB18A31600215EBDF14CF68CD857EE7BB2BF94711F18C169EC499B2A6DB31A940CB91

Function 00A4ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00A4ED2A
_wcslen.LIBCMT ref: 00A4ED3B
_wcslen.LIBCMT ref: 00A4ED79
_wcslen.LIBCMT ref: 00A4EDAF
_wcslen.LIBCMT ref: 00A4EDDF
_wcslen.LIBCMT ref: 00A4EDEF
_wcslen.LIBCMT ref: 00A4EE2B
_wcslen.LIBCMT ref: 00A4EE5A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 6357bc3397384e4d92f6afa2a363e23d64a7ff2357007ee4fad7cedcdd95209d
Instruction ID: 05364d50f3968686b711ca29d43985a22ee6361cd837ca52e245ef5afbea8035
Opcode Fuzzy Hash: 6357bc3397384e4d92f6afa2a363e23d64a7ff2357007ee4fad7cedcdd95209d
Instruction Fuzzy Hash: 03419166C1021C75DB11EBF4D88A9CFB7ACBF49710F508462E918E3162FB34E255C3A5

Function 009FF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00A3682C,00000004,00000000,00000000), ref: 009FF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00A3682C,00000004,00000000,00000000), ref: 00A3F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00A3682C,00000004,00000000,00000000), ref: 00A3F454

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 15d723385b3c761b837f632539c8994aca34d22b65dfdfdb9516ac02f53c1d52
Instruction ID: 0b57a5e72455fc76bc9e920b6c5540b3b17acbbef7d9e3f892f1a1cbeebdd5f4
Opcode Fuzzy Hash: 15d723385b3c761b837f632539c8994aca34d22b65dfdfdb9516ac02f53c1d52
Instruction Fuzzy Hash: F2414D31614688BEC738CB39CCA873A7BA5AF56324F54843CF24B56571D6B6A8C1CB11

Function 00A72D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00A72D1B
GetDC.USER32(00000000), ref: 00A72D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A72D2E
ReleaseDC.USER32(00000000,00000000), ref: 00A72D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00A72D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00A72D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00A75A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00A72DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00A72DE1

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 1705e52106418899e27f068b7a758e99efafb77c128968ca231d28d23282e1c6
Instruction ID: 0df77e16981e6e9f918b2084982a7c461417250a95b0eb15976d515f86b158eb
Opcode Fuzzy Hash: 1705e52106418899e27f068b7a758e99efafb77c128968ca231d28d23282e1c6
Instruction Fuzzy Hash: 10314F72201214BFEB218F54CC89FEB3BADEF49765F048059FE0C9A291D6759C91C7A4

Function 00A45622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00A45637
_memcmp.LIBVCRUNTIME ref: 00A45659
_memcmp.LIBVCRUNTIME ref: 00A45671
_memcmp.LIBVCRUNTIME ref: 00A45684
_memcmp.LIBVCRUNTIME ref: 00A4569E
_memcmp.LIBVCRUNTIME ref: 00A456B1
_memcmp.LIBVCRUNTIME ref: 00A456C9
_memcmp.LIBVCRUNTIME ref: 00A456E4

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 7ba009e90361fd9582f36a5546e50017c91c44ba6296a035526ebc1f7dcbf0d3
Instruction ID: ef66400539ff3507d2a285f697e9ead16147d25ebf70cfa1029845faedba18c8
Opcode Fuzzy Hash: 7ba009e90361fd9582f36a5546e50017c91c44ba6296a035526ebc1f7dcbf0d3
Instruction Fuzzy Hash: FE219279E40A097BD21556319F82FFA739CBEA1784F598430FD089A682F720EE1185A6

Function 00A64FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00A65007
NULL Pointer assignment, xrefs: 00A6502E, 00A65383

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: dc72d9bf97a15774cb179d9f590d1d637570b7593607ae6d48a84f802a2eb86d
Instruction ID: a4c8f47a6b143a1f283f33cfb7ab3a4d0199429ffc085678b1d1d67f3bab697d
Opcode Fuzzy Hash: dc72d9bf97a15774cb179d9f590d1d637570b7593607ae6d48a84f802a2eb86d
Instruction Fuzzy Hash: 1ED1CF71E0060AAFDF10DFA8C891BAEB7B5FF48344F148569E915AB281E770DD45CBA0

Function 00A21522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00A215CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00A21651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A216E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00A216FB

Part of subcall function 00A13820: RtlAllocateHeap.NTDLL(00000000,?,00AB1444,?,009FFDF5,?,?,009EA976,00000010,00AB1440,009E13FC,?,009E13C6,?,009E1129), ref: 00A13852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A21777
__freea.LIBCMT ref: 00A217A2
__freea.LIBCMT ref: 00A217AE

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 012efa8fd36f021d4d94d9d135cc668aba916f9b822a9eafd0273ed876517329
Instruction ID: 72d6aaee4cdb8177245e844b02669e193ae23de45f83ce884d7680e11fa31f2c
Opcode Fuzzy Hash: 012efa8fd36f021d4d94d9d135cc668aba916f9b822a9eafd0273ed876517329
Instruction Fuzzy Hash: F191B571E002269EDF248F68ED81AEEBBB59FA5310F184679E805E7181D735DD41CBA0

Function 00A64523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A64648
VariantInit.OLEAUT32(?), ref: 00A64749
VariantClear.OLEAUT32(?), ref: 00A64753
VariantClear.OLEAUT32(?), ref: 00A647B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00A6472C
Null Object assignment in FOR..IN loop, xrefs: 00A645D8, 00A64706, 00A647BE

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 95ea6cffd22158151e65b0185ad489e39f050258f2e0636c7fd9d5e2d89198f4
Instruction ID: 7473df711471ceefa60c82d125a2f2ca32e1a754a48659dc74187d7ac158a6b4
Opcode Fuzzy Hash: 95ea6cffd22158151e65b0185ad489e39f050258f2e0636c7fd9d5e2d89198f4
Instruction Fuzzy Hash: E5916C71A00219AFDF24CFA5DC88FAEBBB8FF4A714F108559F515AB280D7709945CBA0

Function 00A51187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00A5125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00A51284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00A512A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A512D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A5135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A513C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A51430

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 83fc86babe32ed68f60b1ba980f811538dc144e4d0b609a704060375140db9f3
Instruction ID: 842a968555424fd92988a531e6820dadd6f0d839e45ecd916fc56ef827741b38
Opcode Fuzzy Hash: 83fc86babe32ed68f60b1ba980f811538dc144e4d0b609a704060375140db9f3
Instruction Fuzzy Hash: 7791D275A00209AFDB00DFA8D895BFEB7B5FF45326F104429ED10EB291D778A949CB90

Function 009F948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: df41a3d8b8caa9ea10ac9db2f22c926ccde857ab0226a1514403e5510ed916e2
Instruction ID: 996af1f710dfd2ef9d5e5490b7e328f2104ff25cfd68c3dc7f938e1b2efdce19
Opcode Fuzzy Hash: df41a3d8b8caa9ea10ac9db2f22c926ccde857ab0226a1514403e5510ed916e2
Instruction Fuzzy Hash: 17911671D04219EFCB14CFA9CC84AEEBBB8FF49320F148559EA15B7251D379A942CB60

Function 00A63947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A6396B
CharUpperBuffW.USER32(?,?), ref: 00A63A7A
_wcslen.LIBCMT ref: 00A63A8A
VariantClear.OLEAUT32(?), ref: 00A63C1F

Part of subcall function 00A50CDF: VariantInit.OLEAUT32(00000000), ref: 00A50D1F
Part of subcall function 00A50CDF: VariantCopy.OLEAUT32(?,?), ref: 00A50D28
Part of subcall function 00A50CDF: VariantClear.OLEAUT32(?), ref: 00A50D34

Strings

Incorrect Parameter format, xrefs: 00A639A6, 00A63BA1
AUTOIT.ERROR, xrefs: 00A63A80, 00A63A85

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 3925ab6182ac9c09a8d231a16ce5b2de196f5f490f951799b0004a2d19640c91
Instruction ID: ddfe601ea0918b8784ee6004d7f92a87e0e33f59228e73aa40f660f74648ab24
Opcode Fuzzy Hash: 3925ab6182ac9c09a8d231a16ce5b2de196f5f490f951799b0004a2d19640c91
Instruction Fuzzy Hash: 289133766083459FCB00EF64C48096AB7F4BF89314F14882DF88A9B351DB31EE46CB82

Function 00A64BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00A4000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?,?,00A4035E), ref: 00A4002B
Part of subcall function 00A4000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?), ref: 00A40046
Part of subcall function 00A4000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?), ref: 00A40054
Part of subcall function 00A4000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?), ref: 00A40064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00A64C51
_wcslen.LIBCMT ref: 00A64D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00A64DCF
CoTaskMemFree.OLE32(?), ref: 00A64DDA

Strings

NULL Pointer assignment, xrefs: 00A64E23, 00A64E52

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: b2044f9fd0404e3ec421273d04dd9b1001d0198a5670891cdebbf1f20f9a09c9
Instruction ID: dd7bbe9f0cb4220c8475492d2177236b08190e5ecf88ad7d5aa4baead8a099e3
Opcode Fuzzy Hash: b2044f9fd0404e3ec421273d04dd9b1001d0198a5670891cdebbf1f20f9a09c9
Instruction Fuzzy Hash: 32911571D00219EFDF15DFA4C891AEEB7B9BF48310F108169E915A7291EB34AE45CF60

Function 00A720FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00A72183
GetMenuItemCount.USER32(00000000), ref: 00A721B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00A721DD
_wcslen.LIBCMT ref: 00A72213
GetMenuItemID.USER32(?,?), ref: 00A7224D
GetSubMenu.USER32(?,?), ref: 00A7225B

Part of subcall function 00A43A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A43A57
Part of subcall function 00A43A3D: GetCurrentThreadId.KERNEL32 ref: 00A43A5E
Part of subcall function 00A43A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A425B3), ref: 00A43A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00A722E3

Part of subcall function 00A4E97B: Sleep.KERNELBASE ref: 00A4E9F3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: e69202fc8e04c0d8c895915dfdf231a5f76b87bb37ebb5df98cd199b88b216ff
Instruction ID: acd3e8552d386f321e266aece1d03de50fcdee2bdc25a7f3722dd21aa0fc62ae
Opcode Fuzzy Hash: e69202fc8e04c0d8c895915dfdf231a5f76b87bb37ebb5df98cd199b88b216ff
Instruction Fuzzy Hash: ED715E75A00205AFCB11DFA5CC85BAEB7B5BF88310F14C469E95AEB351D734ED428B90

Function 00A77E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(013CEC78), ref: 00A77F37
IsWindowEnabled.USER32(013CEC78), ref: 00A77F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00A7801E
SendMessageW.USER32(013CEC78,000000B0,?,?), ref: 00A78051
IsDlgButtonChecked.USER32(?,?), ref: 00A78089
GetWindowLongW.USER32(013CEC78,000000EC), ref: 00A780AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00A780C3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 69d38ee50fcdd81ebda1a6b0688e810c26b912dee3eae0b40481aa4e654273a4
Instruction ID: 56bb8e773715b7f634ee3f87f49d776b54c5ba113d0fc1103be3d9179e03abe0
Opcode Fuzzy Hash: 69d38ee50fcdd81ebda1a6b0688e810c26b912dee3eae0b40481aa4e654273a4
Instruction Fuzzy Hash: 68718C34648244AFEB21DF64CE94FAEBBB9EF49300F14C459E94997261CB35AC46DB20

Function 00A4AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00A4AEF9
GetKeyboardState.USER32(?), ref: 00A4AF0E
SetKeyboardState.USER32(?), ref: 00A4AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00A4AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00A4AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00A4AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00A4B020

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4bbdcc4e09801157d10678f99abbd6caa054a5e6c76c5e3ad220086489a6067c
Instruction ID: 28e18ebefac2154a062a26e386b661baf5fe7089258eeb6aec61190507c7611c
Opcode Fuzzy Hash: 4bbdcc4e09801157d10678f99abbd6caa054a5e6c76c5e3ad220086489a6067c
Instruction Fuzzy Hash: 6151D1A46547D53DFB3683388C45BBBBEE95B96304F088489E1E9458C2C3D8EDC8D761

Function 00A4ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00A4AD19
GetKeyboardState.USER32(?), ref: 00A4AD2E
SetKeyboardState.USER32(?), ref: 00A4AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00A4ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00A4ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00A4AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00A4AE38

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 52c7413be5dce405511f36e6e742cf924fc77564018aa0f2864e5d5e85bcd8f6
Instruction ID: 31e561e2cf8400b7ed2ccc7677d620fc0be5cedc846c6b44844485dfae2e68bc
Opcode Fuzzy Hash: 52c7413be5dce405511f36e6e742cf924fc77564018aa0f2864e5d5e85bcd8f6
Instruction Fuzzy Hash: A2510BA5A847E53DFB3783348C46B7A7E985F95300F08844CE1E5468C3D394ED84D762

Function 00A1542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00A23CD6,?,?,?,?,?,?,?,?,00A15BA3,?,?,00A23CD6,?,?), ref: 00A15470
__fassign.LIBCMT ref: 00A154EB
__fassign.LIBCMT ref: 00A15506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00A23CD6,00000005,00000000,00000000), ref: 00A1552C
WriteFile.KERNEL32(?,00A23CD6,00000000,00A15BA3,00000000,?,?,?,?,?,?,?,?,?,00A15BA3,?), ref: 00A1554B
WriteFile.KERNEL32(?,?,00000001,00A15BA3,00000000,?,?,?,?,?,?,?,?,?,00A15BA3,?), ref: 00A15584

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 5d8d17d06ae61d1f8b4a11d825673262b44bc129c0a4e085657e5fb5d78e5849
Instruction ID: fe76f0bff8d727a60f2ed7c0ac879b517c0b8eac465ea10d0f63afd25eb3b0f3
Opcode Fuzzy Hash: 5d8d17d06ae61d1f8b4a11d825673262b44bc129c0a4e085657e5fb5d78e5849
Instruction Fuzzy Hash: 48518F71E00649DFDB10CFB8D885AEEBBFAEF49310F14415AE555E7291D730AA81CB60

Function 00A02D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A02D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00A02D53
_ValidateLocalCookies.LIBCMT ref: 00A02DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00A02E0C
_ValidateLocalCookies.LIBCMT ref: 00A02E61

Strings

csm, xrefs: 00A02DF6

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 52e27469e56eb3c3217ae5f14f3a294b0d8d98385428cfe13f87a41d4397dbaa
Instruction ID: c2f344066ced0d3f1f390c91c3ed532d2893520a5a29129a854e025c545383cd
Opcode Fuzzy Hash: 52e27469e56eb3c3217ae5f14f3a294b0d8d98385428cfe13f87a41d4397dbaa
Instruction Fuzzy Hash: DE419034A0030DABDF10DF68E859B9EBBB5BF45324F148195E814AB3D2D731AE15CB90

Function 00A610B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A6304E: inet_addr.WSOCK32(?), ref: 00A6307A
Part of subcall function 00A6304E: _wcslen.LIBCMT ref: 00A6309B

socket.WSOCK32(00000002,00000001,00000006), ref: 00A61112
WSAGetLastError.WSOCK32 ref: 00A61121
WSAGetLastError.WSOCK32 ref: 00A611C9
closesocket.WSOCK32(00000000), ref: 00A611F9

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 47882dab93dc9b191f523cea8c3114e8f1a5aeab3890a14352414499e054ad26
Instruction ID: 8642c4355cb9d263681c154b0c88ad10aad69c45eddc6a571e1666d111e1fba3
Opcode Fuzzy Hash: 47882dab93dc9b191f523cea8c3114e8f1a5aeab3890a14352414499e054ad26
Instruction Fuzzy Hash: EF41F671600204AFDB10DF54CC84BA9BBF9EF46324F18815DF9199B291D774AD82CBE1

Function 00A4CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A4CF22,?), ref: 00A4DDFD

Part of subcall function 00A4DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A4CF22,?), ref: 00A4DE16

lstrcmpiW.KERNEL32(?,?), ref: 00A4CF45
MoveFileW.KERNEL32(?,?), ref: 00A4CF7F
_wcslen.LIBCMT ref: 00A4D005
_wcslen.LIBCMT ref: 00A4D01B
SHFileOperationW.SHELL32(?), ref: 00A4D061

Strings

\*.*, xrefs: 00A4CFF3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 2ff5d912519a0f2324f852b90660e0592fe38413eb4b486894be5328a3e41a9a
Instruction ID: 01f230290b38968d5c734d8d7361e2765ec4abb5f33a29551f53111c246097d2
Opcode Fuzzy Hash: 2ff5d912519a0f2324f852b90660e0592fe38413eb4b486894be5328a3e41a9a
Instruction Fuzzy Hash: E4418B7594621C5FDF52EFA4DE81ADD77B8AF48340F0000E6E509E7141EB34AB88CB50

Function 00A72DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00A72E1C
GetWindowLongW.USER32(?,000000F0), ref: 00A72E4F
GetWindowLongW.USER32(?,000000F0), ref: 00A72E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00A72EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00A72EE0
GetWindowLongW.USER32(?,000000F0), ref: 00A72EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A72F0B

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 99612a35ee2508781ab12109d75790772704927ad367579e7bdefafc53b33d97
Instruction ID: 8d9f6151cb6756adee5674247e75b840c6e6e6410e060907b53d4b06f4621029
Opcode Fuzzy Hash: 99612a35ee2508781ab12109d75790772704927ad367579e7bdefafc53b33d97
Instruction Fuzzy Hash: D1313730644140AFEB20CF98DC94F653BE0FB8A721F159168F9488F2B2CB71AC81DB41

Function 00A47726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A47769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A4778F
SysAllocString.OLEAUT32(00000000), ref: 00A47792
SysAllocString.OLEAUT32(?), ref: 00A477B0
SysFreeString.OLEAUT32(?), ref: 00A477B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00A477DE
SysAllocString.OLEAUT32(?), ref: 00A477EC

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: da43c42455ca85f415bc09b5891b7534a0682a6acb27ca4bb0b53158bbfe1b7b
Instruction ID: c8f941995343fa561f2ebb862ba412606f70a1b528a62b3fb85d9e5c30432d84
Opcode Fuzzy Hash: da43c42455ca85f415bc09b5891b7534a0682a6acb27ca4bb0b53158bbfe1b7b
Instruction Fuzzy Hash: 5721B27A604219AFDB10DFA8CC88DBF77ACEB493647408029FA15DB150D770DC8287A0

Function 00A477FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A47842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A47868
SysAllocString.OLEAUT32(00000000), ref: 00A4786B
SysAllocString.OLEAUT32 ref: 00A4788C
SysFreeString.OLEAUT32 ref: 00A47895
StringFromGUID2.OLE32(?,?,00000028), ref: 00A478AF
SysAllocString.OLEAUT32(?), ref: 00A478BD

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 5221ceefd9046e3515b92002a9181d58d576f89bce926d34aeaaa0ad72f0536e
Instruction ID: 82e8e3b100cdb72370bce04948fd61bc785e75871b4c73d4e4d57c1665292b2a
Opcode Fuzzy Hash: 5221ceefd9046e3515b92002a9181d58d576f89bce926d34aeaaa0ad72f0536e
Instruction Fuzzy Hash: 1E213E76608204AFDB109BE8DC9CDAA77ACEB497607108125B915DB2A1D774DC81CB64

Function 00A504D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00A504F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A5052E

Strings

nul, xrefs: 00A50567

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: e4c86bbd0a32f488158690039c1f4a846538a83d37faefffcd4aeb0e034ccd9d
Instruction ID: 36a2778513c938689fa0b07ee0dfa7bad20aa975dfac8437089fb5211ab0f85e
Opcode Fuzzy Hash: e4c86bbd0a32f488158690039c1f4a846538a83d37faefffcd4aeb0e034ccd9d
Instruction Fuzzy Hash: D8219FB1500305AFDB209F69DC04E9A7BB4BF54726F208A19FCA1E72E0E7709949CF20

Function 00A505A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00A505C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A50601

Strings

nul, xrefs: 00A50639

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: d4bfd8e7da8ad9f824c846583d7d6592b43532177b8cfa4edef409c95a215639
Instruction ID: b74b7e31f018bd6b9a746082ae1c8466f08e0512743041365f0a08335e65b5bb
Opcode Fuzzy Hash: d4bfd8e7da8ad9f824c846583d7d6592b43532177b8cfa4edef409c95a215639
Instruction Fuzzy Hash: A52181755003069BDB209F69CC04E9A7BE4BF95731F244A19FCA1E72E0D7B099A5CB50

Function 00A740AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009E604C
Part of subcall function 009E600E: GetStockObject.GDI32(00000011), ref: 009E6060
Part of subcall function 009E600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 009E606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00A74112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00A7411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00A7412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00A74139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00A74145

Strings

Msctls_Progress32, xrefs: 00A740E3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: ac5dd93ff48c36d207e18c7e5b40eca1dac6fc8f3223f8d5f0bcd0c99f42dc2e
Instruction ID: 15a7425cccd8a6ef149b1dd99c887d21e6c90541035b7e76e1dd9ea3a392c9b8
Opcode Fuzzy Hash: ac5dd93ff48c36d207e18c7e5b40eca1dac6fc8f3223f8d5f0bcd0c99f42dc2e
Instruction Fuzzy Hash: DF11B6B1140119BEEF119FA4CC85EE77F5DEF08798F008110B618A2050C7769C61DBA4

Function 00A1D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A1D7A3: _free.LIBCMT ref: 00A1D7CC

_free.LIBCMT ref: 00A1D82D

Part of subcall function 00A129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000), ref: 00A129DE
Part of subcall function 00A129C8: GetLastError.KERNEL32(00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000,00000000), ref: 00A129F0

_free.LIBCMT ref: 00A1D838
_free.LIBCMT ref: 00A1D843
_free.LIBCMT ref: 00A1D897
_free.LIBCMT ref: 00A1D8A2
_free.LIBCMT ref: 00A1D8AD
_free.LIBCMT ref: 00A1D8B8

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 0688d5226fc4c351bf6b1cae27f272f01a0746ca4e074453529ed8124d307e66
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 68115E71540B04AAD621BFB0CE47FCB7BDCAF40750F480825B299AE0D2DAA5F5A58760

Function 00A4DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00A4DA74
LoadStringW.USER32(00000000), ref: 00A4DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00A4DA91
LoadStringW.USER32(00000000), ref: 00A4DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00A4DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00A4DAB9

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: c7e698158722d1ab1950bf40b36fa0532a16fb7db9f67314e1d886d34eda1fe7
Instruction ID: 33ff3198537db20a5fbacdae50d31f371b6f3278aa84772a774cc646d9c83637
Opcode Fuzzy Hash: c7e698158722d1ab1950bf40b36fa0532a16fb7db9f67314e1d886d34eda1fe7
Instruction Fuzzy Hash: DF0162F65002087FE711EBE09D89EE7366CE708711F4085A9B71AE2041EA749EC54F74

Function 00A5096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(013BEFE0,013BEFE0), ref: 00A5097B
EnterCriticalSection.KERNEL32(013BEFC0,00000000), ref: 00A5098D
TerminateThread.KERNEL32(?,000001F6), ref: 00A5099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00A509A9
CloseHandle.KERNEL32(?), ref: 00A509B8
InterlockedExchange.KERNEL32(013BEFE0,000001F6), ref: 00A509C8
LeaveCriticalSection.KERNEL32(013BEFC0), ref: 00A509CF

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: dd3a0ea847da816b56bb5a6c49a3c3f09ce54c27878134e14d8fe2d680701866
Instruction ID: 7d4e771fb54c6e2cae231ad2b08bce3d105583d2cc5af6e6b937a970ef568f5e
Opcode Fuzzy Hash: dd3a0ea847da816b56bb5a6c49a3c3f09ce54c27878134e14d8fe2d680701866
Instruction Fuzzy Hash: BEF01D32442512EBD741AB94EE88AD6BB25BF01712F405029F205608A5C77494A6CFD0

Function 009E5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 009E5D30
GetWindowRect.USER32(?,?), ref: 009E5D71
ScreenToClient.USER32(?,?), ref: 009E5D99
GetClientRect.USER32(?,?), ref: 009E5ED7
GetWindowRect.USER32(?,?), ref: 009E5EF8

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 161a62e3e5b909d0b8d7fcf36e07c9a14d2f85bff052c5e04a7e78fb99e76324
Instruction ID: 25b3af59a6e38cf24e48f3bae76226b02508e8adda82a740602b32a699dd8527
Opcode Fuzzy Hash: 161a62e3e5b909d0b8d7fcf36e07c9a14d2f85bff052c5e04a7e78fb99e76324
Instruction Fuzzy Hash: 74B17A34A1078ADBDB10CFA9C4807EEB7F1FF48314F14881AE8A9D7250DB34AA91DB50

Function 00A101B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00A100BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A100D6
__allrem.LIBCMT ref: 00A100ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A1010B
__allrem.LIBCMT ref: 00A10122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A10140

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 73740e5c86c14128681b725d1844897a6f04ff35b9ea84a8025c852cd0ab369a
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 40810672A0070AAFE7249F28DD41FAB73E8AF55324F24463AF551D66C1EBB4D9C08750

Function 00A61D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A63149: select.WSOCK32(00000000,?,00000000,00000000,?), ref: 00A63195

__WSAFDIsSet.WSOCK32(00000000,?), ref: 00A61DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00A61DE1
WSAGetLastError.WSOCK32 ref: 00A61DF2
inet_ntoa.WSOCK32(?), ref: 00A61E8C
htons.WSOCK32(?), ref: 00A61EDB
_strlen.LIBCMT ref: 00A61F35

Part of subcall function 00A439E8: _strlen.LIBCMT ref: 00A439F2

Part of subcall function 009E6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,009FCF58,?,?,?), ref: 009E6DBA
Part of subcall function 009E6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,009FCF58,?,?,?), ref: 009E6DED

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: b2387fcfb2472c01932392de57ae7f944c4ff7d8b9c16aa6e24b066641b1934d
Instruction ID: 7ce903b4cb287e5e29c945b0974065424fd4a7db0dc725caef0155e4ec708d24
Opcode Fuzzy Hash: b2387fcfb2472c01932392de57ae7f944c4ff7d8b9c16aa6e24b066641b1934d
Instruction Fuzzy Hash: 4BA1BE31604340AFC324DF21C895F2A7BB5AFC4318F58894DF5569B2A2DB71ED46CB92

Function 00A161FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00A082D9,00A082D9,?,?,?,00A1644F,00000001,00000001,8BE85006), ref: 00A16258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00A1644F,00000001,00000001,8BE85006,?,?,?), ref: 00A162DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00A163D8
__freea.LIBCMT ref: 00A163E5

Part of subcall function 00A13820: RtlAllocateHeap.NTDLL(00000000,?,00AB1444,?,009FFDF5,?,?,009EA976,00000010,00AB1440,009E13FC,?,009E13C6,?,009E1129), ref: 00A13852

__freea.LIBCMT ref: 00A163EE
__freea.LIBCMT ref: 00A16413

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: b2c0876dba9cda649af8ef3e20bb40b2fd37b446f9c07709ea0bc3405fec44bb
Instruction ID: 39d167d70c7f49903bfb51bb55501b951c02205f8f029cf15ff129a94d9b943d
Opcode Fuzzy Hash: b2c0876dba9cda649af8ef3e20bb40b2fd37b446f9c07709ea0bc3405fec44bb
Instruction Fuzzy Hash: 7451A072A00216AFEF258F64DD81EEF77AAEB44760F154629FD15DA180EB34DCC0D6A0

Function 00A6BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A6C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A6B6AE,?,?), ref: 00A6C9B5
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6C9F1
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA68
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A6BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A6BD25
RegCloseKey.ADVAPI32(00000000), ref: 00A6BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00A6BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00A6BDF3
RegCloseKey.ADVAPI32(?), ref: 00A6BDFF

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: eb0736c27f1cd0ed4b23784dcc55614c3aa3fc577bff6e6389e07b33f94da422
Instruction ID: cac75405ffaa6c7a7b3fdc4bbfae16c835b77e0f8ba2c10a5400beb88ded5741
Opcode Fuzzy Hash: eb0736c27f1cd0ed4b23784dcc55614c3aa3fc577bff6e6389e07b33f94da422
Instruction Fuzzy Hash: 22817A30218241EFC715DF24C881E2ABBF5BF84308F14895CF5598B2A2DB31ED85CBA2

Function 00A3F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00A3F7B9
SysAllocString.OLEAUT32(00000001), ref: 00A3F860
VariantCopy.OLEAUT32(00A3FA64,00000000), ref: 00A3F889
VariantClear.OLEAUT32(00A3FA64), ref: 00A3F8AD
VariantCopy.OLEAUT32(00A3FA64,00000000), ref: 00A3F8B1
VariantClear.OLEAUT32(?), ref: 00A3F8BB

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: c5d6d20af5ce681b2ddedc43394298499e212ecee80582ce3d46673539654c66
Instruction ID: e73286e58fec13ccfbda053a0c8e08bf2c954707c0164eb4812f5d68817d44ae
Opcode Fuzzy Hash: c5d6d20af5ce681b2ddedc43394298499e212ecee80582ce3d46673539654c66
Instruction Fuzzy Hash: 0F51B431E20314BECF24AB65D895B39B3A8EF45710F24946BF906DF296DB708C40CB96

Function 00A5910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 009E7620: _wcslen.LIBCMT ref: 009E7625

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00A594E5
_wcslen.LIBCMT ref: 00A59506
_wcslen.LIBCMT ref: 00A5952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00A59585

Strings

X, xrefs: 00A59412

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: eb4553bbf54d3f04118c106f01ee00c8113d6cb7005111c3a1c6806689bc4a50
Instruction ID: 08ff8bbd20425c914105fab192a4e572ef5b91c091636efed27fb7b3106ab753
Opcode Fuzzy Hash: eb4553bbf54d3f04118c106f01ee00c8113d6cb7005111c3a1c6806689bc4a50
Instruction Fuzzy Hash: FCE18C31508340DFD725EF25C881B6AB7E4BF84314F14896DF9899B2A2EB31DD49CB92

Function 009F920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

BeginPaint.USER32(?,?,?), ref: 009F9241
GetWindowRect.USER32(?,?), ref: 009F92A5
ScreenToClient.USER32(?,?), ref: 009F92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 009F92D3
EndPaint.USER32(?,?,?,?,?), ref: 009F9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00A371EA

Part of subcall function 009F9339: BeginPath.GDI32(00000000), ref: 009F9357

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 307220afe5c5ece8c32908661cd04a356d09ef5458cfad219ac93b46753ae72f
Instruction ID: c4890cad94e5907d555468a509d3f0296073e550cc158e6566ca8738d1c7b5fc
Opcode Fuzzy Hash: 307220afe5c5ece8c32908661cd04a356d09ef5458cfad219ac93b46753ae72f
Instruction Fuzzy Hash: BE41DE71104305AFD721DF64CC94FBA7BB8EF85324F100629FAA8872B2C7719886DB61

Function 00A507EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00A5080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00A50847
EnterCriticalSection.KERNEL32(?), ref: 00A50863
LeaveCriticalSection.KERNEL32(?), ref: 00A508DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00A508F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00A50921

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: b29e33438df61cc151469f0bca0b2567ad978d984e2c62ea7db3c8753667ddc8
Instruction ID: 9a9f22c9ccd9ce06a00f4f3ff87f837db14817f17fc250cbf2c94454814dfc34
Opcode Fuzzy Hash: b29e33438df61cc151469f0bca0b2567ad978d984e2c62ea7db3c8753667ddc8
Instruction Fuzzy Hash: 7D414A71900209EFDF14EF94DC85AAA7779FF44310F1480A9ED04AA29BD730DE65DBA0

Function 00A781DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00A3F3AB,00000000,?,?,00000000,?,00A3682C,00000004,00000000,00000000), ref: 00A7824C
EnableWindow.USER32(?,00000000), ref: 00A78272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00A782D1
ShowWindow.USER32(?,00000004), ref: 00A782E5
EnableWindow.USER32(?,00000001), ref: 00A7830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00A7832F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 04760005be0d11ed32f55f348cb139a64a55a8eeb98d7f5315c8814487410d11
Instruction ID: c5fe63d6c40ec05d4a69b4982599491a988b305ea275d1c9329c91f9c9d1cb8e
Opcode Fuzzy Hash: 04760005be0d11ed32f55f348cb139a64a55a8eeb98d7f5315c8814487410d11
Instruction Fuzzy Hash: 44417034641644AFDB15CF55DC99BE47BE0BB0A715F18C269E61C4F273CB35A842CB90

Function 00A44C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00A44C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00A44CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00A44CEA
_wcslen.LIBCMT ref: 00A44D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00A44D10
_wcsstr.LIBVCRUNTIME ref: 00A44D1A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: a7a7355ea4dabc118bb921e5a50e51bab63c9b940c7395b0d51edffd216f0e0f
Instruction ID: f50c3a059c953ae6b23c10ef2c7cf393ec96c250a3269de87d72d7a12a755479
Opcode Fuzzy Hash: a7a7355ea4dabc118bb921e5a50e51bab63c9b940c7395b0d51edffd216f0e0f
Instruction Fuzzy Hash: D7213B36604204BBEB159B75EC89F7B7BACDF89760F10803DF909CA191DB65CC4183A0

Function 00A5581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 009E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009E3A97,?,?,009E2E7F,?,?,?,00000000), ref: 009E3AC2

_wcslen.LIBCMT ref: 00A5587B
CoInitialize.OLE32(00000000), ref: 00A55995
CoCreateInstance.OLE32(00A7FCF8,00000000,00000001,00A7FB68,?), ref: 00A559AE
CoUninitialize.OLE32 ref: 00A559CC

Strings

.lnk, xrefs: 00A55876, 00A558C1, 00A55985

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 7887eb8146313d81e0b0f89434d23478dc3329410921e2b09f12a4be04b76fa1
Instruction ID: 5fef097707979121dfae34a22492b0866b93e131588f00891a630c7f8ed83eb4
Opcode Fuzzy Hash: 7887eb8146313d81e0b0f89434d23478dc3329410921e2b09f12a4be04b76fa1
Instruction Fuzzy Hash: 55D16271A08701DFC714DF25C494A2ABBE1FF89311F15885DF88A9B261DB31EC49CB92

Function 00A4175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A40FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A40FCA
Part of subcall function 00A40FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A40FD6
Part of subcall function 00A40FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A40FE5
Part of subcall function 00A40FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A40FEC
Part of subcall function 00A40FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A41002

GetLengthSid.ADVAPI32(?,00000000,00A41335), ref: 00A417AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00A417BA
HeapAlloc.KERNEL32(00000000), ref: 00A417C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00A417DA
GetProcessHeap.KERNEL32(00000000,00000000,00A41335), ref: 00A417EE
HeapFree.KERNEL32(00000000), ref: 00A417F5

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: c9fbd982c09dadd12f5bd65585d1c57c791387d660ca54c584aede6b23858dbb
Instruction ID: e773c67d32bcf56adc48cbda9246ba6c2a1e236775098d99c1f8e78c5bc373f8
Opcode Fuzzy Hash: c9fbd982c09dadd12f5bd65585d1c57c791387d660ca54c584aede6b23858dbb
Instruction Fuzzy Hash: 41118E35510205FFDB10DFA4CC49FAE7BB9EB85365F108128F48597210D735A985CF60

Function 00A414CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00A414FF
OpenProcessToken.ADVAPI32(00000000), ref: 00A41506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00A41515
CloseHandle.KERNEL32(00000004), ref: 00A41520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A4154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00A41563

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: c4ae38ea6e994187a3e0c0527fa6c905f2bebbd9d8ff9f0d209077aa30d81fa8
Instruction ID: 8d4488df9fa6ed86bd913e1f6eb01e0a25ec6f19a6429abc2e5e433c3f40e16a
Opcode Fuzzy Hash: c4ae38ea6e994187a3e0c0527fa6c905f2bebbd9d8ff9f0d209077aa30d81fa8
Instruction Fuzzy Hash: 03112976501209ABDF11CFD8DD49FDE7BA9EF88754F048019FA09A2060C3758EA1DB61

Function 00A03382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A03379,00A02FE5), ref: 00A03390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A0339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A033B7
SetLastError.KERNEL32(00000000,?,00A03379,00A02FE5), ref: 00A03409

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ac9327babcd59ba781d830ca563e527adf5b7b601e884f95ec659d6f67c47110
Instruction ID: fd9ddb1469e39eeb5ac252e927b9106aa2caefe10f6d0caadb003e40b44c0b06
Opcode Fuzzy Hash: ac9327babcd59ba781d830ca563e527adf5b7b601e884f95ec659d6f67c47110
Instruction Fuzzy Hash: 1901F73360971ABEFE2567F47DC56672A9CEB06379720022DF610891F0FF224D525644

Function 00A12D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A15686,00A23CD6,?,00000000,?,00A15B6A,?,?,?,?,?,00A0E6D1,?,00AA8A48), ref: 00A12D78
_free.LIBCMT ref: 00A12DAB
_free.LIBCMT ref: 00A12DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00A0E6D1,?,00AA8A48,00000010,009E4F4A,?,?,00000000,00A23CD6), ref: 00A12DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00A0E6D1,?,00AA8A48,00000010,009E4F4A,?,?,00000000,00A23CD6), ref: 00A12DEC
_abort.LIBCMT ref: 00A12DF2

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 396b557ee1dc4186ac677df8500f21cc3d13aae28a3a82e08acfc2ca803ed50f
Instruction ID: cb1fa38b95b6d112d84865b505abc41aaf2bf6cce56a92ca077f0734d935a343
Opcode Fuzzy Hash: 396b557ee1dc4186ac677df8500f21cc3d13aae28a3a82e08acfc2ca803ed50f
Instruction Fuzzy Hash: 7BF0C8365446012BD6227778FD06FDB2669AFC27B1F25451CF828961D2FF34C8E24360

Function 00A78A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 009F9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009F9693
Part of subcall function 009F9639: SelectObject.GDI32(?,00000000), ref: 009F96A2
Part of subcall function 009F9639: BeginPath.GDI32(?), ref: 009F96B9
Part of subcall function 009F9639: SelectObject.GDI32(?,00000000), ref: 009F96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00A78A4E
LineTo.GDI32(?,00000003,00000000), ref: 00A78A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00A78A70
LineTo.GDI32(?,00000000,00000003), ref: 00A78A80
EndPath.GDI32(?), ref: 00A78A90
StrokePath.GDI32(?), ref: 00A78AA0

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: d31bd8bbf4331a68ed0e6bab9853e1e636f9586d03b2eaa2d09ea3d3544cddf6
Instruction ID: 65de5dc117f625dfa262219f96aca85342c495ca8f1a591f21e7a1a1f78c5e11
Opcode Fuzzy Hash: d31bd8bbf4331a68ed0e6bab9853e1e636f9586d03b2eaa2d09ea3d3544cddf6
Instruction Fuzzy Hash: 4C11FA7604014CFFDB119F90DC48EAA7F6DEB04360F00C015BA1995161C7719D96DBA0

Function 00A451FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A45218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00A45229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A45230
ReleaseDC.USER32(00000000,00000000), ref: 00A45238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00A4524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00A45261

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: bcce005c324cf95a0c76eefe57d059e24757d67bd7560be90491ca7e0278e2b9
Instruction ID: 11260f1efa9c6c2d7ec0c2b3674a8743e47456aa86e0f8abdec2832dc8db10a4
Opcode Fuzzy Hash: bcce005c324cf95a0c76eefe57d059e24757d67bd7560be90491ca7e0278e2b9
Instruction Fuzzy Hash: DB014475E00714BBEB109BF59C49A5EBFB8EF54761F048065FA08A7281D6709901CBA0

Function 009E1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 009E1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 009E1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 009E1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 009E1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 009E1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 009E1C22

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 7617b8edb0ae779e4f0df40e3de965e30749cce09db65e61e351d220d8633db1
Instruction ID: 5f5f267bd17d871b74c30819258b1a7034a42c1eabe72fc3a9a2a9ba24ab5fd4
Opcode Fuzzy Hash: 7617b8edb0ae779e4f0df40e3de965e30749cce09db65e61e351d220d8633db1
Instruction Fuzzy Hash: B7016CB09027597DE3008F5A8C85B52FFA8FF19754F00411F915C47941C7F5A864CBE5

Function 00A4EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00A4EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00A4EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00A4EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A4EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A4EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A4EB75

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 285484d4d45bf2ec58c357fbef9a9113d52a2200be49149ce5eed9fc5c617266
Instruction ID: b60a8b43d971b932917df89a78b4a001dfba6e656223e92c724c59fb3d4c51fd
Opcode Fuzzy Hash: 285484d4d45bf2ec58c357fbef9a9113d52a2200be49149ce5eed9fc5c617266
Instruction Fuzzy Hash: 90F05472240158BBE72197929C4DEEF7E7CEFCAB21F00816CF605E1091D7A45A42C6B5

Function 00A37439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00A37452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00A37469
GetWindowDC.USER32(?), ref: 00A37475
GetPixel.GDI32(00000000,?,?), ref: 00A37484
ReleaseDC.USER32(?,00000000), ref: 00A37496
GetSysColor.USER32(00000005), ref: 00A374B0

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 817bd18e36d575a3707b47f7c81836f9f5f0cfc67dedc5d4a37138ac290674b8
Instruction ID: 9ff61ad6898a2d4da1cb3c96fdc2c407799b7969f608afc79363b9a6ed53afcf
Opcode Fuzzy Hash: 817bd18e36d575a3707b47f7c81836f9f5f0cfc67dedc5d4a37138ac290674b8
Instruction Fuzzy Hash: 74016D31404215EFDB619FA4DC08BAE7BB5FF04321F518168F91AA31A1CB312E92EB50

Function 00A41874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A4187F
UnloadUserProfile.USERENV(?,?), ref: 00A4188B
CloseHandle.KERNEL32(?), ref: 00A41894
CloseHandle.KERNEL32(?), ref: 00A4189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00A418A5
HeapFree.KERNEL32(00000000), ref: 00A418AC

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: cf18f1f56d5fb6f8e9b98055d2361b60297d30dbbfa9fa2395f43f7997b46fe9
Instruction ID: 3ede784d8e47db2bff872a8c43750ff132ddae28a159854ad7c81595369a019c
Opcode Fuzzy Hash: cf18f1f56d5fb6f8e9b98055d2361b60297d30dbbfa9fa2395f43f7997b46fe9
Instruction Fuzzy Hash: 2FE0C236004101BBEA019BE1ED1C90ABB29FB49B32B50C228F22995470CB3294A2DB50

Function 00A4C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E7620: _wcslen.LIBCMT ref: 009E7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A4C6EE
_wcslen.LIBCMT ref: 00A4C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A4C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00A4C7CA

Strings

0, xrefs: 00A4C6AF

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 560078f8a75ea04904e80ef1241221703726c44108e27afe86852e3fea79cb70
Instruction ID: 21926fe21e5c850439661bb8ae1effa4be1060b6bec65f3670831c2dc7ce0c92
Opcode Fuzzy Hash: 560078f8a75ea04904e80ef1241221703726c44108e27afe86852e3fea79cb70
Instruction Fuzzy Hash: A551FC796063409BD794DF28C884BABB7E8AFC9324F044A2DF999D31A1DB60DD04CB52

Function 00A6AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00A6AEA3

Part of subcall function 009E7620: _wcslen.LIBCMT ref: 009E7625

GetProcessId.KERNEL32(00000000), ref: 00A6AF38
CloseHandle.KERNEL32(00000000), ref: 00A6AF67

Strings

<, xrefs: 00A6AE6B
@, xrefs: 00A6AE72

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: afbd5f9591aeee636270ea26fb5c07e0b3da6d64e87cdf874390e2acf1608b63
Instruction ID: 7f80aedf24d75d00c5ec20d043cd0109c55d247ea0ae841021085a9045450f94
Opcode Fuzzy Hash: afbd5f9591aeee636270ea26fb5c07e0b3da6d64e87cdf874390e2acf1608b63
Instruction Fuzzy Hash: 35717770A00659DFCB15DF95D484A9EBBF0BF48310F048499E81AAB3A2CB35ED41CF92

Function 00A4719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00A47206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00A4723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00A4724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00A472CF

Strings

DllGetClassObject, xrefs: 00A47242

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 6e432d8bc62afb9362fb8d539411eda82239d1bc8873614443ba9e3f00d2841f
Instruction ID: 56d2c63b78ba5348a675e568b7d6081e2b98ac257954f3ecb47c367b899cb535
Opcode Fuzzy Hash: 6e432d8bc62afb9362fb8d539411eda82239d1bc8873614443ba9e3f00d2841f
Instruction Fuzzy Hash: F2414D75604244EFDB15CF64C884ADE7BB9EF84710F1480ADBD099F24AD7B1DA45CBA0

Function 00A73D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A73E35
IsMenu.USER32(?), ref: 00A73E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A73E92
DrawMenuBar.USER32 ref: 00A73EA5

Strings

0, xrefs: 00A73D89

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: d3219c4858775c6006a79c2df24034ad7f4310e3e2d959f497b4a04500b0f5cd
Instruction ID: e2fc7cdcf475372d7fecb70d260dc168b776eadae2c9a660a8b27099d96788f2
Opcode Fuzzy Hash: d3219c4858775c6006a79c2df24034ad7f4310e3e2d959f497b4a04500b0f5cd
Instruction Fuzzy Hash: 5C414976A01209AFDF10DF90DC84AAABBF5FF48354F05C129E909A7250D730AE45DF50

Function 00A41DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A43CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00A41E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00A41E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00A41EA9

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

Strings

ComboBox, xrefs: 00A41DF0
ListBox, xrefs: 00A41E25

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 8d3577c3a2846e0d0b1a8321d8b55a4f140b209e6daea5a65c67bb758cc5472c
Instruction ID: c3e3663afa60706bae22a7a1037b2127632379f5ec6cd1b5f543d733d42f1ead
Opcode Fuzzy Hash: 8d3577c3a2846e0d0b1a8321d8b55a4f140b209e6daea5a65c67bb758cc5472c
Instruction Fuzzy Hash: 61214979A00104BEDB14ABA1CC86DFFB7B9EFC1360B14851DF815A31E1EB384D8A8620

Function 00A6C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A6C9F1
_wcslen.LIBCMT ref: 00A6CA68
_wcslen.LIBCMT ref: 00A6CA9E
_wcslen.LIBCMT ref: 00A6CAF9
_wcslen.LIBCMT ref: 00A6CB2F
_wcslen.LIBCMT ref: 00A6CB7F

Strings

HKLM, xrefs: 00A6CA98, 00A6CA9D
HKEY_LOCAL_MACHINE, xrefs: 00A6CA62, 00A6CA67

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: c996988b1c06e7110a568047e1b410f4e471cd3d8170843e1f573c5047f78a26
Instruction ID: 7bc82b68a07c0261f14f2067fc6773f459bcba561680df31dc267e290658aba9
Opcode Fuzzy Hash: c996988b1c06e7110a568047e1b410f4e471cd3d8170843e1f573c5047f78a26
Instruction Fuzzy Hash: 5631E673A001694BCB21DFACD9501BF33B39BB17E0B554129EC95AB395FA71CE8093A0

Function 00A72F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00A72F8D
LoadLibraryW.KERNEL32(?), ref: 00A72F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00A72FA9
DestroyWindow.USER32(?), ref: 00A72FB1

Strings

SysAnimate32, xrefs: 00A72F68

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: f871a5f446fda158273697b84ced68a32cfa9da835d1549b3ffda485d47eb8c4
Instruction ID: eaee05b089cba99e92c69d940398796130b3afa466cafb9a8747d2427b388c48
Opcode Fuzzy Hash: f871a5f446fda158273697b84ced68a32cfa9da835d1549b3ffda485d47eb8c4
Instruction Fuzzy Hash: DF219D72204205ABEF218FA4DC80FBB77BDEB99364F10C629F958D61A0D771DCA19760

Function 00A04D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00A04D1E,00A128E9,?,00A04CBE,00A128E9,00AA88B8,0000000C,00A04E15,00A128E9,00000002), ref: 00A04D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A04DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00A04D1E,00A128E9,?,00A04CBE,00A128E9,00AA88B8,0000000C,00A04E15,00A128E9,00000002,00000000), ref: 00A04DC3

Strings

CorExitProcess, xrefs: 00A04D98
mscoree.dll, xrefs: 00A04D86

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9834451355d8042c179f69aa892b4cd8f9ae603f66d009cd6b1810a90c22a1f4
Instruction ID: ea2f7e8eb30b25a9f92960d86b935b1c7568f3997ffeaac9f6db5da062b8e29b
Opcode Fuzzy Hash: 9834451355d8042c179f69aa892b4cd8f9ae603f66d009cd6b1810a90c22a1f4
Instruction Fuzzy Hash: 4CF0447464020CBBEB119F90DC49B9EBFB5FF44762F444168F909A2190CB345981CB91

Function 009E4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,009E4EDD,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009E4EAE
FreeLibrary.KERNEL32(00000000,?,?,009E4EDD,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 009E4EA8
kernel32.dll, xrefs: 009E4E94

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 45941b8e4005abc8bfcf7b95d2797acd167f1b0a470f305f81942b3df4c748ef
Instruction ID: 94185684a14da738ad3db233f3c07da456c6c94afbd880811ee5e33e823d3338
Opcode Fuzzy Hash: 45941b8e4005abc8bfcf7b95d2797acd167f1b0a470f305f81942b3df4c748ef
Instruction Fuzzy Hash: 75E0CD36E015626BD2335B666C18B5F665CBFC1F73B05822DFC08D3140DB64CD4285A0

Function 009E4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A23CDE,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009E4E74
FreeLibrary.KERNEL32(00000000,?,?,00A23CDE,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4E87

Strings

kernel32.dll, xrefs: 009E4E5B
Wow64RevertWow64FsRedirection, xrefs: 009E4E6E

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 2b21254ad06e106f176cd31f027bec698400c310f0682b4d0263c8532828cc5a
Instruction ID: 23d828b6c85603e4e070e4c5ec1f7977e438758e76757bf904bf60651b9e8f07
Opcode Fuzzy Hash: 2b21254ad06e106f176cd31f027bec698400c310f0682b4d0263c8532828cc5a
Instruction Fuzzy Hash: 81D0C23290266277CA231B667C08D8F6A1CBF89F32349862CB809A2110CF24CD42C5D1

Function 00A52947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A52C05
DeleteFileW.KERNEL32(?), ref: 00A52C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00A52C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A52CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A52CC0

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 005fcff4e64bf3ed9cf7ddf24de28fa48f154725d1c5cec4d842d326fbd102b4
Instruction ID: 350ef674eea323a32a1b511f207f9f2e129e31b771dc734c774e587b1273a484
Opcode Fuzzy Hash: 005fcff4e64bf3ed9cf7ddf24de28fa48f154725d1c5cec4d842d326fbd102b4
Instruction Fuzzy Hash: C5B13C7290011DABDF11DBA4CD85FDEB7BDFF49355F1040A6FA09E6141EA309A488FA1

Function 00A6A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00A6A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00A6A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00A6A468
CloseHandle.KERNEL32(?), ref: 00A6A63D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: a13304a77d3d5c46ebe272fa881a9f204686f5b1c47e5325730e688b6305eff9
Instruction ID: 1d60d0ebea12f4edd12c411bcc7193d86e5e683aa0693e2f8356fc4cd35e2432
Opcode Fuzzy Hash: a13304a77d3d5c46ebe272fa881a9f204686f5b1c47e5325730e688b6305eff9
Instruction Fuzzy Hash: 3AA19F75604300AFD720DF25C886F2AB7E5AF94714F14885DF59A9B2D2DBB0EC418B92

Function 00A4E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A4CF22,?), ref: 00A4DDFD

Part of subcall function 00A4DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A4CF22,?), ref: 00A4DE16

Part of subcall function 00A4E199: GetFileAttributesW.KERNEL32(?,00A4CF95), ref: 00A4E19A

lstrcmpiW.KERNEL32(?,?), ref: 00A4E473
MoveFileW.KERNEL32(?,?), ref: 00A4E4AC
_wcslen.LIBCMT ref: 00A4E5EB
_wcslen.LIBCMT ref: 00A4E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00A4E650

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 8327d1e43fa2bb1600bb43f19886e72a280eab7765b860457c927c19dcaa4f62
Instruction ID: 27646718416eb92d735458c10f23b687554443021144bd1f7845e46494d94368
Opcode Fuzzy Hash: 8327d1e43fa2bb1600bb43f19886e72a280eab7765b860457c927c19dcaa4f62
Instruction Fuzzy Hash: CB5174B64083859BC724EB94DC819DFB3ECAFC4350F00492EF589D3191EF75A6888B66

Function 00A6B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A6C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A6B6AE,?,?), ref: 00A6C9B5
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6C9F1
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA68
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A6BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A6BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00A6BB63
RegCloseKey.ADVAPI32(?,?), ref: 00A6BBA6
RegCloseKey.ADVAPI32(00000000), ref: 00A6BBB3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 512b8cc145c404e633f87eb0a44089cbaab9270238a4bc6a1ad6c9de26b3e2d2
Instruction ID: 007d237af0d41e11fcf0c5af6118333dfa23f0e4243f8cfba79b17aa38ba6077
Opcode Fuzzy Hash: 512b8cc145c404e633f87eb0a44089cbaab9270238a4bc6a1ad6c9de26b3e2d2
Instruction Fuzzy Hash: 0F619131218241AFD315DF54C890E2ABBF5FF84358F54855CF4998B2A2DB31ED86CBA2

Function 00A48BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A48BCD
VariantClear.OLEAUT32 ref: 00A48C3E
VariantClear.OLEAUT32 ref: 00A48C9D
VariantClear.OLEAUT32(?), ref: 00A48D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00A48D3B

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 6760888629e2ebd1403dbfe72497cd99f9b8872027e898dadbfa929be0feee45
Instruction ID: 3df878347e153340c3f8efc32fe8013b1d4b8ee30696ea27dd5269e74612b3be
Opcode Fuzzy Hash: 6760888629e2ebd1403dbfe72497cd99f9b8872027e898dadbfa929be0feee45
Instruction Fuzzy Hash: 365167B5A01219EFCB10CF68D894AAAB7F8FF89314B158569E909DB350E734E911CF90

Function 00A58AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00A58BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00A58BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00A58C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00A58C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00A58C5F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 95438b7739c813a5f186d9cf5a253dd7bbb5a969da317f0a4e37628d3a399a7f
Instruction ID: c8755bead06010dc8f3cddfcc7f8ff5a743f7790ae6f39e9218566170c42d53d
Opcode Fuzzy Hash: 95438b7739c813a5f186d9cf5a253dd7bbb5a969da317f0a4e37628d3a399a7f
Instruction Fuzzy Hash: 7C516C35A00618AFCB01DF65C881E6DBBF5FF48314F088458E849AB362DB35ED55CB91

Function 00A68EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00A68F40
GetProcAddress.KERNEL32(00000000,?), ref: 00A68FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00A68FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00A69032
FreeLibrary.KERNEL32(00000000), ref: 00A69052

Part of subcall function 009FF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00A51043,?,753CE610), ref: 009FF6E6
Part of subcall function 009FF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00A3FA64,00000000,00000000,?,?,00A51043,?,753CE610,?,00A3FA64), ref: 009FF70D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 7b85208ca2c4f71d589cd8baac6845e354fb1e9c58f0d5de46045645a4bab71e
Instruction ID: 689c7afb1ed1362caa04a3d4c7c81b92c138a07ec184e049b7942f0923d7c248
Opcode Fuzzy Hash: 7b85208ca2c4f71d589cd8baac6845e354fb1e9c58f0d5de46045645a4bab71e
Instruction Fuzzy Hash: 63514D35600245DFCB11DF68C4949AEBBF5FF49324B0581A8E90A9B362DB31ED86CB91

Function 00A76B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00A76C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00A76C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00A76C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00A5AB79,00000000,00000000), ref: 00A76C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00A76CC7

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 0076a06888de1cd389b395412e6b00cfbe2b01e35c734cab5ad9ecd71c43f329
Instruction ID: 78c5d54b9e9d07e8c39268a53c57f0f3f182da6d44771afc7444308ae77b9217
Opcode Fuzzy Hash: 0076a06888de1cd389b395412e6b00cfbe2b01e35c734cab5ad9ecd71c43f329
Instruction Fuzzy Hash: 8141D435604504AFD726CF78CD58FAA7BA5EB49360F14C268F89DA72E1C371AD41CA40

Function 00A12051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A120C3
_free.LIBCMT ref: 00A120E3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ce19ecbb1f71c9ce52459e96a9340d85d3966fcb9b37f9a8dd43bf770180488b
Instruction ID: 1ea00a12ee5874044ffb4731a41aa6206a59c32eee69532992d4afcab5488dd5
Opcode Fuzzy Hash: ce19ecbb1f71c9ce52459e96a9340d85d3966fcb9b37f9a8dd43bf770180488b
Instruction Fuzzy Hash: 5B41D232A00204AFDB24DF78C981B9DB7B5EF89324F154668E615EB391DB31ED51CB80

Function 009F912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 009F9141
ScreenToClient.USER32(00000000,?), ref: 009F915E
GetAsyncKeyState.USER32(00000001), ref: 009F9183
GetAsyncKeyState.USER32(00000002), ref: 009F919D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: f84d5cd2a54423ad6ca9e7dfadc4cd146af2812db2340d822a5a45e84c0d6212
Instruction ID: 675f5b480609a6c2aaa40043d3a1a382a01391a32485c420e16625028525f2b2
Opcode Fuzzy Hash: f84d5cd2a54423ad6ca9e7dfadc4cd146af2812db2340d822a5a45e84c0d6212
Instruction Fuzzy Hash: 48414F71A0861AFBDF159F64C844BFEB774FB05324F20832AF529A72A0C7346950DB91

Function 00A53874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00A538CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00A53922
TranslateMessage.USER32(?), ref: 00A5394B
DispatchMessageW.USER32(?), ref: 00A53955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A53966

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: b7ffe7d1aaf2553f1b479b2106e5158670d983fb6dca56e398028294e3bcd772
Instruction ID: ef926945a83d61325c9f99103bbe1b905bdb9e2bec18a785703ae04fbb4ca2f7
Opcode Fuzzy Hash: b7ffe7d1aaf2553f1b479b2106e5158670d983fb6dca56e398028294e3bcd772
Instruction Fuzzy Hash: 72311BB2504341DEEF35CBB49C68BB637E8BB41382F44455DE852C20A1E3F4968ECB11

Function 00A5CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00A5CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00A5CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00A5C21E,00000000), ref: 00A5CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00A5C21E,00000000), ref: 00A5CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00A5C21E,00000000), ref: 00A5CFF2

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 9f73d274c89a3f0cc2f0526f18a1f335ccfdb1e9d77101a15d56cb8f24d12765
Instruction ID: 0466abcf146dfca9120b4e909d376ad28bd9d749d29035f6ee761a86e26ff1d4
Opcode Fuzzy Hash: 9f73d274c89a3f0cc2f0526f18a1f335ccfdb1e9d77101a15d56cb8f24d12765
Instruction Fuzzy Hash: 0A317F71600305AFDB24DFA5CC84AABBBF9FF14322B10842EF906D2145DB30AD49DB60

Function 00A41901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A41915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00A419C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00A419C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00A419DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00A419E2

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: a2067ca4730e3e4d400ff7751697140dddf79a15f93868eadf6d8bdf2ec9c421
Instruction ID: 58589c74e98d3409c595e35ea498523beea2a693a4ffcda11270d9e36bd6a61d
Opcode Fuzzy Hash: a2067ca4730e3e4d400ff7751697140dddf79a15f93868eadf6d8bdf2ec9c421
Instruction Fuzzy Hash: 6531B475A00219EFCB04CFA8CD99ADE7BB5FB44325F108229F925A72D1C7709D94DB90

Function 00A75706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00A75745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00A7579D
_wcslen.LIBCMT ref: 00A757AF
_wcslen.LIBCMT ref: 00A757BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A75816

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 49a0e2a70fb0dde5a57c3d7db4fd88c0adaac32c66f6130cbc0929e4ec5456f7
Instruction ID: f7928fd440bc9961a3fca08175903cefc8c7261324e0a6c019d2ad594798e4f6
Opcode Fuzzy Hash: 49a0e2a70fb0dde5a57c3d7db4fd88c0adaac32c66f6130cbc0929e4ec5456f7
Instruction Fuzzy Hash: 2B217171D046189ADB209FB4DC85AEE77B8FF04725F10C61AEA2DEA1C0D7B49985CF50

Function 009F990F Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009F98CC
SetTextColor.GDI32(?,?), ref: 009F98D6
SetBkMode.GDI32(?,00000001), ref: 009F98E9
GetStockObject.GDI32(00000005), ref: 009F98F1
GetWindowLongW.USER32(?,000000EB), ref: 009F9952

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: 1f89f116b3fa3097e07dfd5a6916d666ccbabdee8d1e04dbcf312721cc08c0e5
Instruction ID: 95f4b3b4095c73b89ebbfc5295139f0ace1d76436b9a51920a3984d05a4b44e0
Opcode Fuzzy Hash: 1f89f116b3fa3097e07dfd5a6916d666ccbabdee8d1e04dbcf312721cc08c0e5
Instruction Fuzzy Hash: 69212831145254DFCB22CF61ECA4BF93B74EF26370B58415EF5528B1A1C7754882CB51

Function 00A60930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00A60951
GetForegroundWindow.USER32 ref: 00A60968
GetDC.USER32(00000000), ref: 00A609A4
GetPixel.GDI32(00000000,?,00000003), ref: 00A609B0
ReleaseDC.USER32(00000000,00000003), ref: 00A609E8

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 010876109e3ca5e255add8becc19191aff32baaecdee4bb1aa01265ee87485a6
Instruction ID: 902fc1152bc20970a80cb79c77d1876795d2da0859364ecf13dd59e7005727e9
Opcode Fuzzy Hash: 010876109e3ca5e255add8becc19191aff32baaecdee4bb1aa01265ee87485a6
Instruction Fuzzy Hash: 86216D36600204AFD704EFA5DD85AAEBBF9EF48711F04846CF85AA7362DB70AD45CB50

Function 00A1CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00A1CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A1CDE9

Part of subcall function 00A13820: RtlAllocateHeap.NTDLL(00000000,?,00AB1444,?,009FFDF5,?,?,009EA976,00000010,00AB1440,009E13FC,?,009E13C6,?,009E1129), ref: 00A13852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00A1CE0F
_free.LIBCMT ref: 00A1CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A1CE31

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: a2d86546fd788d77a3fb3c4ce099119e2ac538b985da2735316e602d866d9c7e
Instruction ID: b2befdc3982a28565ebfd58f54ae4f056e31cd7b1449fc4972621cbb4992c5fa
Opcode Fuzzy Hash: a2d86546fd788d77a3fb3c4ce099119e2ac538b985da2735316e602d866d9c7e
Instruction Fuzzy Hash: 6401D4726412157FA3215BBA6C88DBF696DDFC6BB1315412DF909C7240EA608D8282B0

Function 009F9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009F9693
SelectObject.GDI32(?,00000000), ref: 009F96A2
BeginPath.GDI32(?), ref: 009F96B9
SelectObject.GDI32(?,00000000), ref: 009F96E2

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 36a82c860e96e2f2d2b46c3fe31d98a383f1bdbee76c6939448d53526afe8870
Instruction ID: b22d05983a30ec6228efa8ad4b63dc8ce8f29336e0f717f0bd7cca2388961fc1
Opcode Fuzzy Hash: 36a82c860e96e2f2d2b46c3fe31d98a383f1bdbee76c6939448d53526afe8870
Instruction Fuzzy Hash: AD218070802349EBDB11DFA4DC287B93BA8BB40325F90431AF524E61B2D3705893CF94

Function 00A45711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00A45726
_memcmp.LIBVCRUNTIME ref: 00A45744
_memcmp.LIBVCRUNTIME ref: 00A45757
_memcmp.LIBVCRUNTIME ref: 00A4576F
_memcmp.LIBVCRUNTIME ref: 00A45787

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: bf750035db019a7988f6074ada1cc02f5aea1b8b9f8502e43b6273165b4e3999
Instruction ID: cab96bffaaed1fff9cd6659e17c20ccfe90db82d826c2cdd9e1cac62d8295499
Opcode Fuzzy Hash: bf750035db019a7988f6074ada1cc02f5aea1b8b9f8502e43b6273165b4e3999
Instruction Fuzzy Hash: BE017EB5A41609BFD6085621DE41FFB735DAFA1355F008831FD08AE582F761ED11C2B1

Function 00A12DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00A0F2DE,00A13863,00AB1444,?,009FFDF5,?,?,009EA976,00000010,00AB1440,009E13FC,?,009E13C6), ref: 00A12DFD
_free.LIBCMT ref: 00A12E32
_free.LIBCMT ref: 00A12E59
SetLastError.KERNEL32(00000000,009E1129), ref: 00A12E66
SetLastError.KERNEL32(00000000,009E1129), ref: 00A12E6F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: b1dc947cccd455d4add203780093018a22046a88895bcff9573b1267a182be40
Instruction ID: 091b411c653234675fe413f7bff2a347a9432364660961154390452131d2333d
Opcode Fuzzy Hash: b1dc947cccd455d4add203780093018a22046a88895bcff9573b1267a182be40
Instruction Fuzzy Hash: 20012D322456006BD61277746D45FEB1E6DABD13B1B25412CF419E71D2EF34CCE24320

Function 00A4000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?,?,00A4035E), ref: 00A4002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?), ref: 00A40046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?), ref: 00A40054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?), ref: 00A40064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?), ref: 00A40070

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 727f02c90de4041fff44b9160a82e36e82c8772004d56934b2302b94e1f02e5d
Instruction ID: d1845c034055e6f89088b9adbb84e2116e00a7b66303b2161aff4b16ec5c534e
Opcode Fuzzy Hash: 727f02c90de4041fff44b9160a82e36e82c8772004d56934b2302b94e1f02e5d
Instruction Fuzzy Hash: E6014476600214BFDB118FA9DC44FAA7AADEBC4762F148128FE09D6210D775DD419760

Function 00A410F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A41114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A41120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A4112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A41136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A4114D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: bf85500af108747e469fd75c2ff74399e9fc116fd75ca04d644aa54c714c7bfe
Instruction ID: 85033c2307c0163f23194736001e89af61e6db2e0970d84e1548a6bc68e664e6
Opcode Fuzzy Hash: bf85500af108747e469fd75c2ff74399e9fc116fd75ca04d644aa54c714c7bfe
Instruction Fuzzy Hash: F6018179100205BFDB118FA8DC49E6A3F6EEF85375B10442CFA45C7350DB31DC818A60

Function 00A40FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A40FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A40FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A40FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A40FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A41002

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c2a8f4f3ef2aeebb2e784dcaa81337d8af4cc496652801f0685689e4f0d99293
Instruction ID: 9089c659121e3538dcbe03f250bb45197e384a60fc2ac339171f059202a7b0af
Opcode Fuzzy Hash: c2a8f4f3ef2aeebb2e784dcaa81337d8af4cc496652801f0685689e4f0d99293
Instruction Fuzzy Hash: 64F04F39100311ABD7218FA4AC49F563FADEFC9761F508428F94AD6251CA70DC818A60

Function 00A41014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A4102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A41036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A41045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A4104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A41062

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 5aef5095e3379088456ba9d5962ff4c73c2d5a17aa1b93be2c914b4b49c2d236
Instruction ID: e55aff7e7d89463eaf8ed88d29367716ce26af055cbfb930b16c9e6a6d4633c8
Opcode Fuzzy Hash: 5aef5095e3379088456ba9d5962ff4c73c2d5a17aa1b93be2c914b4b49c2d236
Instruction Fuzzy Hash: 69F06D39200311EBDB219FE4EC59F563BADEFC9761F504428FA49D7250CA70D8928A60

Function 00A5030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00A5017D,?,00A532FC,?,00000001,00A22592,?), ref: 00A50324
CloseHandle.KERNEL32(?,?,?,?,00A5017D,?,00A532FC,?,00000001,00A22592,?), ref: 00A50331
CloseHandle.KERNEL32(?,?,?,?,00A5017D,?,00A532FC,?,00000001,00A22592,?), ref: 00A5033E
CloseHandle.KERNEL32(?,?,?,?,00A5017D,?,00A532FC,?,00000001,00A22592,?), ref: 00A5034B
CloseHandle.KERNEL32(?,?,?,?,00A5017D,?,00A532FC,?,00000001,00A22592,?), ref: 00A50358
CloseHandle.KERNEL32(?,?,?,?,00A5017D,?,00A532FC,?,00000001,00A22592,?), ref: 00A50365

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3838e14a8d96642dc291496c386988b1bc7e01c2b5a34336dad3b76a6ae7d208
Instruction ID: 2e0457d3bc8c972b6f0a61e3c59c239a9b58e803a40c2e30003282602e693082
Opcode Fuzzy Hash: 3838e14a8d96642dc291496c386988b1bc7e01c2b5a34336dad3b76a6ae7d208
Instruction Fuzzy Hash: D301A272800B159FC7309F66D890812F7F5BF603263158A3FD19656931C371A959CF80

Function 00A1D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A1D752

Part of subcall function 00A129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000), ref: 00A129DE
Part of subcall function 00A129C8: GetLastError.KERNEL32(00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000,00000000), ref: 00A129F0

_free.LIBCMT ref: 00A1D764
_free.LIBCMT ref: 00A1D776
_free.LIBCMT ref: 00A1D788
_free.LIBCMT ref: 00A1D79A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5f59d58a562c69ea029c2e4f6d056a2cb07d961ed805da26bc32026bcd6cc9a
Instruction ID: 3538a5f99551ff7b4ec4e1e81d3065ee57594ffec17d0a18499f5d31aaf5e27b
Opcode Fuzzy Hash: d5f59d58a562c69ea029c2e4f6d056a2cb07d961ed805da26bc32026bcd6cc9a
Instruction Fuzzy Hash: D3F01232544315ABD621EBA8FAC5D9677DDBB45770B980C05F048EB581CB34FCD087A4

Function 00A45C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00A45C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00A45C6F
MessageBeep.USER32(00000000), ref: 00A45C87
KillTimer.USER32(?,0000040A), ref: 00A45CA3
EndDialog.USER32(?,00000001), ref: 00A45CBD

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 8e68580337e5afc6564c6f0440df9163c2f863feccc81014a678bb8b898ef6f4
Instruction ID: a13d3b310de56dcbe6b61dc11eeec60e08b022c76f99266ae0828d3573183e5b
Opcode Fuzzy Hash: 8e68580337e5afc6564c6f0440df9163c2f863feccc81014a678bb8b898ef6f4
Instruction Fuzzy Hash: 1A018634900B04ABEB359B60DDCEFA677B8BB40B05F04555DA587A10E1DBF0A9858B91

Function 00A122A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A122BE

Part of subcall function 00A129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000), ref: 00A129DE
Part of subcall function 00A129C8: GetLastError.KERNEL32(00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000,00000000), ref: 00A129F0

_free.LIBCMT ref: 00A122D0
_free.LIBCMT ref: 00A122E3
_free.LIBCMT ref: 00A122F4
_free.LIBCMT ref: 00A12305

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4adbf3da7dadf683cadc4ff0a6bf755c9695872fb389b65230d61225dba250ac
Instruction ID: 098dccbe0ed8aafe571b918c5edf7f2b49612ccd96ac2cc42118842c7715834a
Opcode Fuzzy Hash: 4adbf3da7dadf683cadc4ff0a6bf755c9695872fb389b65230d61225dba250ac
Instruction Fuzzy Hash: 34F017719001218BC612EFE8AD01EE93B64F7597B0B40065AF410DA2B2C73488B3AFE4

Function 009F95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 009F95D4
StrokeAndFillPath.GDI32(?,?,00A371F7,00000000,?,?,?), ref: 009F95F0
SelectObject.GDI32(?,00000000), ref: 009F9603
DeleteObject.GDI32 ref: 009F9616
StrokePath.GDI32(?), ref: 009F9631

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 7e9e2bd3561d576eb53f18adcc13c7bd529d0632effa3fd8baf9355c43e64e60
Instruction ID: b293593ece3b9995c0bf19c20daee233f28a0384950458286663d4b1a81bb2ec
Opcode Fuzzy Hash: 7e9e2bd3561d576eb53f18adcc13c7bd529d0632effa3fd8baf9355c43e64e60
Instruction Fuzzy Hash: 0BF0C931005248EBDB26DFA5ED287A43B69AB01336F948318F569950F2C7348997DF64

Function 00A10F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00A110F9
__freea.LIBCMT ref: 00A11117

Part of subcall function 00A11537: _free.LIBCMT ref: 00A1154F

Strings

am/pm, xrefs: 00A1117A
a/p, xrefs: 00A111DE

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 4c88d1b8f189451aa7910a497768b8888ed2407eeccbfc922e23309a86e9e969
Instruction ID: ca5ef0e74781311c039c81119c3beed808da2a91f940ff99ca236aca32cced2a
Opcode Fuzzy Hash: 4c88d1b8f189451aa7910a497768b8888ed2407eeccbfc922e23309a86e9e969
Instruction Fuzzy Hash: A3D11331A00206DACB689F68C985BFEB7B5FF05300F280269EB51AF654E3759DC1CB91

Function 00A67B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00A00242: EnterCriticalSection.KERNEL32(00AB070C,00AB1884,?,?,009F198B,00AB2518,?,?,?,009E12F9,00000000), ref: 00A0024D
Part of subcall function 00A00242: LeaveCriticalSection.KERNEL32(00AB070C,?,009F198B,00AB2518,?,?,?,009E12F9,00000000), ref: 00A0028A

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A000A3: __onexit.LIBCMT ref: 00A000A9

__Init_thread_footer.LIBCMT ref: 00A67BFB

Part of subcall function 00A001F8: EnterCriticalSection.KERNEL32(00AB070C,?,?,009F8747,00AB2514), ref: 00A00202
Part of subcall function 00A001F8: LeaveCriticalSection.KERNEL32(00AB070C,?,009F8747,00AB2514), ref: 00A00235

Strings

Variable must be of type 'Object'., xrefs: 00A67C3A
G, xrefs: 00A67C7F
5, xrefs: 00A67C78

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: d17d5ecfa71a93e7c72dd839cd1ca5c31ee7bd48c07169ea0eda23a70d882d18
Instruction ID: fdebbb12c69bd7398ecea6547093a3cfcec2f5b2ab65fa933f5aa7ccb47d5d05
Opcode Fuzzy Hash: d17d5ecfa71a93e7c72dd839cd1ca5c31ee7bd48c07169ea0eda23a70d882d18
Instruction Fuzzy Hash: B091AC70A14209EFCB15EF94D991EBDB7B5FF48308F108459F8069B2A2DB31AE45CB51

Function 00A42716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A421D0,?,?,00000034,00000800,?,00000034), ref: 00A4B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00A42760

Part of subcall function 00A4B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A421FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00A4B3F8

Part of subcall function 00A4B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00A4B355
Part of subcall function 00A4B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00A42194,00000034,?,?,00001004,00000000,00000000), ref: 00A4B365
Part of subcall function 00A4B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00A42194,00000034,?,?,00001004,00000000,00000000), ref: 00A4B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A427CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A4281A

Strings

@, xrefs: 00A42832

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 3085f626876979f49db3a0cbff5010af70f713273f4d8fbcba3da0d08adf9d83
Instruction ID: ee08882e03969139e4f17f8b0be7ca92c04151bdaf0d103245606103a68e0868
Opcode Fuzzy Hash: 3085f626876979f49db3a0cbff5010af70f713273f4d8fbcba3da0d08adf9d83
Instruction Fuzzy Hash: B0412F76900218AFDB10DFA4CD85BDEBBB8EF45700F104099FA55B7181DB70AE85CB61

Function 00A1172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00A11769
_free.LIBCMT ref: 00A11834
_free.LIBCMT ref: 00A1183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00A11760, 00A11767, 00A11796, 00A117CE

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: 57bd124b8b059718815a46dac57a474f9fee2652538e7404f9ee4f65fae3754a
Instruction ID: bf717bcf98341873f9dae5228b2ff7c3587543b52a5418f758f9a86b40b7bf8b
Opcode Fuzzy Hash: 57bd124b8b059718815a46dac57a474f9fee2652538e7404f9ee4f65fae3754a
Instruction Fuzzy Hash: D9318D71A00218AFDB21DF999981DDEBBFCEB85310F50816AFA0497252D6708E81CB90

Function 00A4C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00A4C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00A4C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00AB1990,013CE9F8), ref: 00A4C395

Strings

0, xrefs: 00A4C2DF

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 12d2506a6e27651d680b4894bdeab71ae653f29ab724ddf4c766a87a564d8f5b
Instruction ID: 450d23cef6ca7b6bb87e383c3399c025dd0aaf671e4f05aa7a5749746eb1c1e4
Opcode Fuzzy Hash: 12d2506a6e27651d680b4894bdeab71ae653f29ab724ddf4c766a87a564d8f5b
Instruction Fuzzy Hash: A841BF3A2063019FD720DF25D884B5ABBE4AFC5320F108A1DF9A99B2D1D770F904CB62

Function 00A74416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00A7CC08,00000000,?,?,?,?), ref: 00A744AA
GetWindowLongW.USER32 ref: 00A744C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A744D7

Strings

SysTreeView32, xrefs: 00A7447C

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: e785782263d06a9556aa7020870065e85425ab4a980fd0071eb4f2199292d5c9
Instruction ID: 2e2a8fdbdf7db68c3c05b27c3c394fae67bbbc46f468b89dde428044f5b8c204
Opcode Fuzzy Hash: e785782263d06a9556aa7020870065e85425ab4a980fd0071eb4f2199292d5c9
Instruction Fuzzy Hash: C3318D31210605AFDB218F78DC85BEA7BA9EB48334F24C715F979921E0DB70EC919B50

Function 00A6304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A6335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00A63077,?,?), ref: 00A63378

inet_addr.WSOCK32(?), ref: 00A6307A
_wcslen.LIBCMT ref: 00A6309B
htons.WSOCK32(00000000), ref: 00A63106

Strings

255.255.255.255, xrefs: 00A63095, 00A6309A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: bc963e267b4c23ce38140c6b7662fef18b2b4ef46927e977fdecee229129c35e
Instruction ID: 38fb22210e180a6155bddf9d5151135e4259f057cc0eba31a616ea365fc2545f
Opcode Fuzzy Hash: bc963e267b4c23ce38140c6b7662fef18b2b4ef46927e977fdecee229129c35e
Instruction Fuzzy Hash: E031D3366042059FCF20CF68C985EAA77F0EF55318F258159E9158B392DB32EE86CB61

Function 00A73EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00A73F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00A73F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A73F78

Strings

SysMonthCal32, xrefs: 00A73F0B

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: c43b9ff651f8e472a9db93bb12271a32cd83e472d51f1cbfb57083080b1ac328
Instruction ID: ab1acf956e5c9549f891b57e6d4870a47407c52cc5f29d85ea6f85e32a2d8378
Opcode Fuzzy Hash: c43b9ff651f8e472a9db93bb12271a32cd83e472d51f1cbfb57083080b1ac328
Instruction Fuzzy Hash: 8C21AD33600219BFDF21CF90CC86FEA3B79EB48764F118214FA196B1D0D6B5A8519B90

Function 00A74653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00A74705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00A74713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00A7471A

Strings

msctls_updown32, xrefs: 00A74684

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 02dc5d7f154b0c092e988c406c6df5d4fed1c7f6f6112496f7ad49d6aed5ee6a
Instruction ID: f0fda2409eff3e573d129ee09ec743060c6a69b1f8bd6ca60a2afa37b74c1f31
Opcode Fuzzy Hash: 02dc5d7f154b0c092e988c406c6df5d4fed1c7f6f6112496f7ad49d6aed5ee6a
Instruction Fuzzy Hash: 0E2162B5600209AFEB11DF64DCD1DB737ADEB9A3A4B048559F50497261D730EC52CB60

Function 00A495AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A4961D

Strings

#requireadmin, xrefs: 00A495D9
#notrayicon, xrefs: 00A495B7
#OnAutoItStartRegister, xrefs: 00A495F3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 68f38fa16d4322aada15146e6d55d4cd06637e875182b29c57547d8cd7189b52
Instruction ID: 04c5bfdb12e51ec2e00ab07bff0b92cf9a5284ef4bbecb367c31d5c750d21591
Opcode Fuzzy Hash: 68f38fa16d4322aada15146e6d55d4cd06637e875182b29c57547d8cd7189b52
Instruction Fuzzy Hash: 5A216D761041106AD331BB25EC02FB7F3E8AFD5320F108426F94997081EB55DE65C3D6

Function 00A737B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00A73840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00A73850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00A73876

Strings

Listbox, xrefs: 00A7380F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: c666ea712031c93f36a5960174d87977d927bb1e6c55ac2932566ef8a1b6a304
Instruction ID: 179967f76e75d69fd9f43d453f19e784a4ba05be9a410cf2ac5a66e431e345bd
Opcode Fuzzy Hash: c666ea712031c93f36a5960174d87977d927bb1e6c55ac2932566ef8a1b6a304
Instruction Fuzzy Hash: 2C217C72610218BBEF21CF95DC85EAB376AEF89760F11C124F9489B190CA769C5297A0

Function 00A549F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A54A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00A54A5C
SetErrorMode.KERNEL32(00000000,?,?,00A7CC08), ref: 00A54AD0

Strings

%lu, xrefs: 00A54A6F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 11fcb965b81b8665aaa42196a859e114dd9945152c6c4a04c2cde7a53b741d3d
Instruction ID: 96003dca389e0e4fe26107b63463abdcb973f2bb0d132342365f70c057e32458
Opcode Fuzzy Hash: 11fcb965b81b8665aaa42196a859e114dd9945152c6c4a04c2cde7a53b741d3d
Instruction Fuzzy Hash: 87316175A00108AFDB11DF54C985EAA77F8EF48318F1480A9F909DB252D771ED85CB61

Function 00A741EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00A7424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00A74264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00A74271

Strings

msctls_trackbar32, xrefs: 00A74226

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: fb2065f5bf3d3a7bf09c86ebf2e9fa19bf0021b8ee3392ac209bb9677f7a01ce
Instruction ID: f5d5add783575f199ead714e6aaa68cd32b58b52ea035cf7ef2b62bbf4bedae8
Opcode Fuzzy Hash: fb2065f5bf3d3a7bf09c86ebf2e9fa19bf0021b8ee3392ac209bb9677f7a01ce
Instruction Fuzzy Hash: 9A110431340248BEEF219F69CC05FAB37ACEB89754F118514FA58E2090C371DC218750

Function 00A42F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

Part of subcall function 00A42DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00A42DC5
Part of subcall function 00A42DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A42DD6
Part of subcall function 00A42DA7: GetCurrentThreadId.KERNEL32 ref: 00A42DDD
Part of subcall function 00A42DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00A42DE4

GetFocus.USER32 ref: 00A42F78

Part of subcall function 00A42DEE: GetParent.USER32(00000000), ref: 00A42DF9

GetClassNameW.USER32(?,?,00000100), ref: 00A42FC3
EnumChildWindows.USER32(?,00A4303B), ref: 00A42FEB

Strings

%s%d, xrefs: 00A42FFF

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: d428f72f0ec5c4330ba3e6bcaa17ae98d8c0d8f71447a61edd6b717cd3dbd490
Instruction ID: 571e21a6d5c524181033e04e23a49fcce16b79526db96bc0691d5974068998e6
Opcode Fuzzy Hash: d428f72f0ec5c4330ba3e6bcaa17ae98d8c0d8f71447a61edd6b717cd3dbd490
Instruction Fuzzy Hash: 4511A2756002056BCF15BF708D95FED37AAAFD4314F048079B9099B192DE709A458B60

Function 00A75882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00A758C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00A758EE
DrawMenuBar.USER32(?), ref: 00A758FD

Strings

0, xrefs: 00A7588F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: ad678c5eab5e23156222e8a43dce23e8705c7faed4dfbcb50d149a7ff15b127a
Instruction ID: e2800deeecfd8259e661d69e04d98dc7e9669eb3b61d5396fa1aa2dfa1950a39
Opcode Fuzzy Hash: ad678c5eab5e23156222e8a43dce23e8705c7faed4dfbcb50d149a7ff15b127a
Instruction Fuzzy Hash: D4016931900218EFDB219F61DC44BAEBBB5FF85361F10C0A9E94DDA161DB718A84EF21

Function 00A3D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00A3D3BF
FreeLibrary.KERNEL32 ref: 00A3D3E5

Strings

X64, xrefs: 00A3D2A8
GetSystemWow64DirectoryW, xrefs: 00A3D3B9

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 6b3cdf440500a6ec3b8a77ecf1009a8cc0d19f9cd6aa70af1c6e6a484d1c931e
Instruction ID: 3fd3446d6caa19a8099610a12e11a3c58f02e949fe78249d2337bb7c10d1a7c7
Opcode Fuzzy Hash: 6b3cdf440500a6ec3b8a77ecf1009a8cc0d19f9cd6aa70af1c6e6a484d1c931e
Instruction Fuzzy Hash: 6BF02371506621D7D77157509C549EF7334AF10702F98C67DF805FA145DB34CD808792

Function 00A4007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e91b45be97558461d231fa8c577fe650b2e6c98c10bceb8abe3241cf0b5c66
Instruction ID: 39dd592b74aad4e7ba42914209f3f1819e059c1a15804f60b7e201664b55ac8a
Opcode Fuzzy Hash: 46e91b45be97558461d231fa8c577fe650b2e6c98c10bceb8abe3241cf0b5c66
Instruction Fuzzy Hash: 17C13B79A00206EFDB14CF98C894EAAB7B5FF88704F118598E605DF251D771ED41EB90

Function 00A13E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A13F0B
__alldvrm.LIBCMT ref: 00A1410C
__alldvrm.LIBCMT ref: 00A1412E

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: d2209187ce887789aeff8893bbdf612ae65406e93d08fe0bb1338260e20edcb3
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 50A12772D00396AFEB15CF1DC8917EABBF5EF69350F18426DE5859B281C23889C2C750

Function 00A6342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A63459
CoUninitialize.OLE32 ref: 00A63463
VariantInit.OLEAUT32(?), ref: 00A6346E
VariantClear.OLEAUT32(?), ref: 00A6371B

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 40c41a9429df2a50caaba8103d0813728931c189b061684e57a6b5ef2bc449c5
Instruction ID: d593a88a8ce9072771ae2958a4b41ececfdb462428693cb64747afb20680341e
Opcode Fuzzy Hash: 40c41a9429df2a50caaba8103d0813728931c189b061684e57a6b5ef2bc449c5
Instruction Fuzzy Hash: B5A129766047009FCB11DF69C585A2AB7F5FF88714F048859F98A9B362DB30EE01CB52

Function 00A40436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00A7FC08,?), ref: 00A405F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00A7FC08,?), ref: 00A40608
CLSIDFromProgID.OLE32(?,?,00000000,00A7CC40,000000FF,?,00000000,00000800,00000000,?,00A7FC08,?), ref: 00A4062D
_memcmp.LIBVCRUNTIME ref: 00A4064E

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 4b2664e6e660b11db7f4ff6328ce11435a90dbef21dfd154e6c3305358b5bfbe
Instruction ID: a0557a7cf372e51c49093d5fcc1bada9d0de3dbb6c90710b5525bf558518f78d
Opcode Fuzzy Hash: 4b2664e6e660b11db7f4ff6328ce11435a90dbef21dfd154e6c3305358b5bfbe
Instruction Fuzzy Hash: 89812A75A00109EFCB04DF94C984EEEB7B9FF89315F208558F606AB250DB71AE06DB61

Function 00A21391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A214C0

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ac3c047fc9b89c780dd44b5a8486877f8291403dee6adac5dc8819990aab8b61
Instruction ID: cd9047606eb8880714f495f5c45531e97385e4610a8bd66127d35497c57119c2
Opcode Fuzzy Hash: ac3c047fc9b89c780dd44b5a8486877f8291403dee6adac5dc8819990aab8b61
Instruction Fuzzy Hash: A6417C71A00224ABDB31BBFCBD456FE3AB5EF65370F144235F81DD61D1E63488819261

Function 00A76278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A762E2
ScreenToClient.USER32(?,?), ref: 00A76315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00A76382

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: e40de07bf242ddfafc17d0b12e053a69eb73d7004e7b0588a5e78cab43e44d7f
Instruction ID: 7be122507cf35fc2e06579b5d077de315f549eac785aae2867a3e84b484278dd
Opcode Fuzzy Hash: e40de07bf242ddfafc17d0b12e053a69eb73d7004e7b0588a5e78cab43e44d7f
Instruction Fuzzy Hash: AC510C74A00649EFDB14DF64DD81AAE7BB5FB45360F10C259F8199B2A1D730ED81CB90

Function 00A61AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00A61AFD
WSAGetLastError.WSOCK32 ref: 00A61B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00A61B8A
WSAGetLastError.WSOCK32 ref: 00A61B94

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 9f0a278cb23d0633303dd4024b0903e4a3f34a55af82ee7e6f68bb4d2c72e9d4
Instruction ID: 268eb412a2ffc6bdf4580b2e2b0445d70aa1a0d1de284af54a0ec0f5c6e89749
Opcode Fuzzy Hash: 9f0a278cb23d0633303dd4024b0903e4a3f34a55af82ee7e6f68bb4d2c72e9d4
Instruction Fuzzy Hash: 544171746002006FE721AF25C886F297BE5AB84718F58C458FA5A9F3D3E772DD428B91

Function 00A1B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4574c1f27524aa660c7ce1969d25361698d20724c2314ea0d180b7e171c85e93
Instruction ID: ebbfad41e4814c6d334772168ecccd3709d27ffa553be46f8a4633727286b86c
Opcode Fuzzy Hash: 4574c1f27524aa660c7ce1969d25361698d20724c2314ea0d180b7e171c85e93
Instruction Fuzzy Hash: 28411771A10314BFD7249F7CCD41BEABBE9EB88720F10852EF152DB682D771998187A0

Function 00A556D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00A55783
GetLastError.KERNEL32(?,00000000), ref: 00A557A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00A557CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00A557FA

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 40ac8dba9bf8b3aeac4f8e24f708e148abb4bb1247eda9aea88c68f71117b127
Instruction ID: 50a72c385253b7ddd75892b91452b25c0874558eff994c9f7278f8b64279df03
Opcode Fuzzy Hash: 40ac8dba9bf8b3aeac4f8e24f708e148abb4bb1247eda9aea88c68f71117b127
Instruction Fuzzy Hash: ED411C35600A50DFCB11EF55C544A5ABBE1AF89321B188888FC4A5B362CB30FD45CB91

Function 00A1D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00A06D71,00000000,00000000,00A082D9,?,00A082D9,?,00000001,00A06D71,8BE85006,00000001,00A082D9,00A082D9), ref: 00A1D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A1D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00A1D9AB
__freea.LIBCMT ref: 00A1D9B4

Part of subcall function 00A13820: RtlAllocateHeap.NTDLL(00000000,?,00AB1444,?,009FFDF5,?,?,009EA976,00000010,00AB1440,009E13FC,?,009E13C6,?,009E1129), ref: 00A13852

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 60ca3249fe4f7e9771528186b17fa92cd1af6578789353f6afe4f8e433a87ffb
Instruction ID: 886468f808012974360a37e3238771b09cad0a5ffb6f12d590e2c652da6d2fa8
Opcode Fuzzy Hash: 60ca3249fe4f7e9771528186b17fa92cd1af6578789353f6afe4f8e433a87ffb
Instruction Fuzzy Hash: 2B31AE72A0020AABDF24DF64DD45EEE7BA5EB40320B054168FC04D7190EB35DD91CBA0

Function 00A752C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00A75352
GetWindowLongW.USER32(?,000000F0), ref: 00A75375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A75382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A753A8

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: ed171ee5f561c4ccefa69aa5f59c248efa14db541fab340b77e83458b542fc38
Instruction ID: fb608a8430c8e5229e96f3f3911320abeb4e9b526c63a724a90f19b33f053759
Opcode Fuzzy Hash: ed171ee5f561c4ccefa69aa5f59c248efa14db541fab340b77e83458b542fc38
Instruction Fuzzy Hash: 7031E234E55A08EFFB349B74CC66BE83765AB05390F58C105FA189A2F1C7F4AD80AB41

Function 00A4AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00A4ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00A4AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00A4AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00A4ACC6

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: ea0efdc1c6d2dc5bdbc9fb0d4fc0fdace814bedca8225b8fa86426c8e8007aa1
Instruction ID: f42c67ec57c639faa36c22e2cf087b695206c037eac74cd4a1549daf8958045f
Opcode Fuzzy Hash: ea0efdc1c6d2dc5bdbc9fb0d4fc0fdace814bedca8225b8fa86426c8e8007aa1
Instruction Fuzzy Hash: 35313938A80318AFEF34CBA48C857FA7BB5ABE9320F04831AE485531D0C37589818792

Function 00A77674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00A7769A
GetWindowRect.USER32(?,?), ref: 00A77710
PtInRect.USER32(?,?,00A78B89), ref: 00A77720
MessageBeep.USER32(00000000), ref: 00A7778C

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 3d574887175c5fba487168f5224b20c42b5c22e218b759f3018f1da59ed3ef50
Instruction ID: 1d61a10688283a715a380abc1484d7ffa55eef367dc3ed07318cdec7f1be50a6
Opcode Fuzzy Hash: 3d574887175c5fba487168f5224b20c42b5c22e218b759f3018f1da59ed3ef50
Instruction Fuzzy Hash: B8416B34A05254EFCB15CFA8CC94EADB7F5FB49314F55C1A8E8189B261C731A942CF90

Function 00A716DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00A716EB

Part of subcall function 00A43A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A43A57
Part of subcall function 00A43A3D: GetCurrentThreadId.KERNEL32 ref: 00A43A5E
Part of subcall function 00A43A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A425B3), ref: 00A43A65

GetCaretPos.USER32(?), ref: 00A716FF
ClientToScreen.USER32(00000000,?), ref: 00A7174C
GetForegroundWindow.USER32 ref: 00A71752

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 34db521f7e318cc880ed0a617153096aa8011f1ce5e2da60f3769ec11cb5fa3c
Instruction ID: c767f8df2e9a37fa97c9df06f9c4893cf9b3ff43b3236b265f4a09e2d1dc807b
Opcode Fuzzy Hash: 34db521f7e318cc880ed0a617153096aa8011f1ce5e2da60f3769ec11cb5fa3c
Instruction Fuzzy Hash: D1314175D00149AFCB05DFAAC881DAEB7F9EF88304B5480A9E455E7211D7319E45CFA1

Function 00A4DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 009E7620: _wcslen.LIBCMT ref: 009E7625

_wcslen.LIBCMT ref: 00A4DFCB
_wcslen.LIBCMT ref: 00A4DFE2
_wcslen.LIBCMT ref: 00A4E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00A4E018

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 7d5c78b6ffc5365844a52ca39695e541b7abd9b0e2333e93bf2e9f88549a7ff2
Instruction ID: 5f470082809233f0c84e81f899aafbee27447af0f703c29d0b88dc4cea2fa216
Opcode Fuzzy Hash: 7d5c78b6ffc5365844a52ca39695e541b7abd9b0e2333e93bf2e9f88549a7ff2
Instruction Fuzzy Hash: C621E775900218AFCB20DFA8D981B6EB7F8FFC5750F104065E915BB281D7709D41CBA1

Function 00A4D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A4D501
Process32FirstW.KERNEL32(00000000,?), ref: 00A4D50F
Process32NextW.KERNEL32(00000000,?), ref: 00A4D52F
CloseHandle.KERNEL32(00000000), ref: 00A4D5DC

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 895712e9c453281ce6fb7e2710c976e58099d47b27710f4fbafc1ba385acca02
Instruction ID: 4e11bf618c363ca653b9899d23bd63d3fab1ab5da229d16318eebbeb893259b8
Opcode Fuzzy Hash: 895712e9c453281ce6fb7e2710c976e58099d47b27710f4fbafc1ba385acca02
Instruction Fuzzy Hash: 6C318D71108340AFD301EF54C881BAFBBE8EFD9354F54492DF585861A2EB71A989CB93

Function 00A78FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

GetCursorPos.USER32(?), ref: 00A79001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00A37711,?,?,?,?,?), ref: 00A79016
GetCursorPos.USER32(?), ref: 00A7905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00A37711,?,?,?), ref: 00A79094

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 6e2568b116f9b8f4b779ca1b231a9368ab025e5c38adc6036b3d334f4aba4f16
Instruction ID: a73ccfc85fde10fddc8bb48123628d4946f018774448a24488fbcaa13145cd9a
Opcode Fuzzy Hash: 6e2568b116f9b8f4b779ca1b231a9368ab025e5c38adc6036b3d334f4aba4f16
Instruction Fuzzy Hash: BC218D35610018AFDB25CF94CC98EFB7BB9FB89360F14C15AF90947261C3329992DB61

Function 00A4D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00A7CB68), ref: 00A4D2FB
GetLastError.KERNEL32 ref: 00A4D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00A4D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00A7CB68), ref: 00A4D376

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 372e6769273ff5894a3516332b17eae2bc062d24404d96370ee51b5a076b519f
Instruction ID: 240da16770b90e38ff67945fada7502e5a633a82a2181d480bebd12ae0f67b1e
Opcode Fuzzy Hash: 372e6769273ff5894a3516332b17eae2bc062d24404d96370ee51b5a076b519f
Instruction Fuzzy Hash: 3721A3785042019FC710EF64C8814AA77E4EFD5324F508A5DF499DB2A1E731ED46CB93

Function 00A41571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A41014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A4102A
Part of subcall function 00A41014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A41036
Part of subcall function 00A41014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A41045
Part of subcall function 00A41014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A4104C
Part of subcall function 00A41014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A41062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00A415BE
_memcmp.LIBVCRUNTIME ref: 00A415E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A41617
HeapFree.KERNEL32(00000000), ref: 00A4161E

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: e924297dd1269f76adf504a6d3c11479796e33f3abe32a432399575c446a9c29
Instruction ID: 2573c2352fe244460d9889787582f946196d345ecbdc6c679246b2cef993891a
Opcode Fuzzy Hash: e924297dd1269f76adf504a6d3c11479796e33f3abe32a432399575c446a9c29
Instruction Fuzzy Hash: 7C219A31E00218EFDF00DFA4C945BEEB7B8EF84354F098459E445AB241E730AA85CBA1

Function 00A72782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00A7280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A72824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A72832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00A72840

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: eaea24416d79c4248a06704ff82f5e6f7704c5e7801cd0d3061c3e92e30136a5
Instruction ID: 499ba98fdd2d8645383fb416dced10d4b616f5a79124485c54ea5855e091f9ed
Opcode Fuzzy Hash: eaea24416d79c4248a06704ff82f5e6f7704c5e7801cd0d3061c3e92e30136a5
Instruction Fuzzy Hash: 8521AF31604511AFD715DB24CC45FAA7BA9AF85324F14C15CF42A8B6E2CB72FC82CB91

Function 00A478F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A48D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00A4790A,?,000000FF,?,00A48754,00000000,?,0000001C,?,?), ref: 00A48D8C
Part of subcall function 00A48D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00A48DB2
Part of subcall function 00A48D7D: lstrcmpiW.KERNEL32(00000000,?,00A4790A,?,000000FF,?,00A48754,00000000,?,0000001C,?,?), ref: 00A48DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00A48754,00000000,?,0000001C,?,?,00000000), ref: 00A47923
lstrcpyW.KERNEL32(00000000,?), ref: 00A47949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00A48754,00000000,?,0000001C,?,?,00000000), ref: 00A47984

Strings

cdecl, xrefs: 00A4797B

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 62ba95e27345ad50ce2b749ffa951c53ba2af50933365ae2b458e31025b5fbaa
Instruction ID: ab0acb2437251cb354436694ebea459d431b33e70662abc13351dd508473a4bd
Opcode Fuzzy Hash: 62ba95e27345ad50ce2b749ffa951c53ba2af50933365ae2b458e31025b5fbaa
Instruction Fuzzy Hash: 5511E63E200382ABCB159F34DC45E7E77A9FFC5350B50802AF946CB2A5EB719851C7A1

Function 00A77CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00A77D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00A77D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00A77D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00A5B7AD,00000000), ref: 00A77D6B

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: c396d63df7b79dce37475d42963f95d5906560282ce3d13a27b17ce43b257ace
Instruction ID: b29e1c22c16b6ec7dba0dca9265dfe9bf60e4cf0e86fc07e4d649408523480eb
Opcode Fuzzy Hash: c396d63df7b79dce37475d42963f95d5906560282ce3d13a27b17ce43b257ace
Instruction Fuzzy Hash: D911CD31204614AFCB20CFA8CC04AAA3BA4AF45370B15C728F83DC72F1D7318961DB80

Function 00A75660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00A756BB
_wcslen.LIBCMT ref: 00A756CD
_wcslen.LIBCMT ref: 00A756D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A75816

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: ce72cc0fbd556e0fbe2078722884b5add67aef36d5e36cab575d0ec18f85ff5f
Instruction ID: 6c312e4c687cfba12f9633ceaf88d6824afc16ab4a5ffe1d09266bd84cf63b03
Opcode Fuzzy Hash: ce72cc0fbd556e0fbe2078722884b5add67aef36d5e36cab575d0ec18f85ff5f
Instruction Fuzzy Hash: 8C11B171E00608A6DB20DFB19C85AEE77BCBF11761F50C42AFA1DD6081E7B49A80CB60

Function 00A11D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a21c7b261a955cfbea86f85fee807263b014f46f2b5f3b2ece6d6abbcaa145
Instruction ID: 7a6cea9bc530399c16255bc3aafe019c2b71ed63c1a1f0fc1543876e0b377a85
Opcode Fuzzy Hash: b3a21c7b261a955cfbea86f85fee807263b014f46f2b5f3b2ece6d6abbcaa145
Instruction Fuzzy Hash: A80162B22096167EF61116B87CC1FA7666DDF817B8B340329F621551D2DB608C915160

Function 00A41A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00A41A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A41A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A41A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A41A8A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f72a223ce1e94407d47f00999362b2fe03fe873478010fb44017bc5ba59fe39a
Instruction ID: d6e41136e51368ba729be845ba1c236ab4fc4f90830fbdb63f8f102b0d41862d
Opcode Fuzzy Hash: f72a223ce1e94407d47f00999362b2fe03fe873478010fb44017bc5ba59fe39a
Instruction Fuzzy Hash: 15113C3AD01219FFEB10DBA4CD85FADBB78EB04750F2004A5E604B7290D6716E50DB94

Function 00A4E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A4E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00A4E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00A4E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00A4E24D

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: d7278759842da5f3161ee589ddee27c4283ba9d7056977d37379ccdbae5ff6a0
Instruction ID: 95ffd5f735e3f66edc9ac22c7134a31625f9500294edd7e8d04bde5190f319d7
Opcode Fuzzy Hash: d7278759842da5f3161ee589ddee27c4283ba9d7056977d37379ccdbae5ff6a0
Instruction Fuzzy Hash: FB110876904214BBCB01DBE89C05ADF7FECAB85320F408329F915E7291E6B0890187A0

Function 00A0D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00A0CFF9,00000000,00000004,00000000), ref: 00A0D218
GetLastError.KERNEL32 ref: 00A0D224
__dosmaperr.LIBCMT ref: 00A0D22B
ResumeThread.KERNEL32(00000000), ref: 00A0D249

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 832c8cc2926075f00f11b1e0a760e405737eae5653d5e93afe69d9592067de91
Instruction ID: 56ec073d200a18acf10dadfad81c8e15a5d1703cd2a2fe882d266ff53771bfad
Opcode Fuzzy Hash: 832c8cc2926075f00f11b1e0a760e405737eae5653d5e93afe69d9592067de91
Instruction Fuzzy Hash: 5E01C03780520CBBDB21ABE5EC09BEA7A69EF85730F104319F929A61D0CF70895187A0

Function 00A79EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

GetClientRect.USER32(?,?), ref: 00A79F31
GetCursorPos.USER32(?), ref: 00A79F3B
ScreenToClient.USER32(?,?), ref: 00A79F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00A79F7A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: bd4cfbf18fa27ad3c3455c065500f18b58c9f76869356acf1272061767f0540d
Instruction ID: c9e0348efc842015961dfa3a6e4600f45241c4b697dc43f77bb620c23c8095d5
Opcode Fuzzy Hash: bd4cfbf18fa27ad3c3455c065500f18b58c9f76869356acf1272061767f0540d
Instruction Fuzzy Hash: 5311483290051AABDB10DFA8DC959EF77B8FB45311F40845AF905E3151D730BA82CBA1

Function 009E600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009E604C
GetStockObject.GDI32(00000011), ref: 009E6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 009E606A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 483cdb40861ad9350ba7f42e7a41fd6214cf3124f50da7ee9f3941fcc327b863
Instruction ID: ca2aa4f76f2d9db83009ce8a4875873541cd330f62689f747c330cffc9b604af
Opcode Fuzzy Hash: 483cdb40861ad9350ba7f42e7a41fd6214cf3124f50da7ee9f3941fcc327b863
Instruction Fuzzy Hash: 1B11AD72101598BFEF129FA69C44EEABB6DEF183A5F004215FA0452020D736ACA0DBA0

Function 00A03B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00A03B56

Part of subcall function 00A03AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00A03AD2
Part of subcall function 00A03AA3: ___AdjustPointer.LIBCMT ref: 00A03AED

_UnwindNestedFrames.LIBCMT ref: 00A03B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00A03B7C
CallCatchBlock.LIBVCRUNTIME ref: 00A03BA4

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 69e4a26b9d61cd75ec55bba729d08fa70cfd3a56dc1324ce68fe8d587da0b09b
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 2801177210014CBBDF126F95ED42EEB3B6DFF89758F044414FE4856161C732E9619BA0

Function 00A13073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,009E13C6,00000000,00000000,?,00A1301A,009E13C6,00000000,00000000,00000000,?,00A1328B,00000006,FlsSetValue), ref: 00A130A5
GetLastError.KERNEL32(?,00A1301A,009E13C6,00000000,00000000,00000000,?,00A1328B,00000006,FlsSetValue,00A82290,FlsSetValue,00000000,00000364,?,00A12E46), ref: 00A130B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00A1301A,009E13C6,00000000,00000000,00000000,?,00A1328B,00000006,FlsSetValue,00A82290,FlsSetValue,00000000), ref: 00A130BF

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 368db495e192b04939e868f49799014853fb9bf12ef44e910105ddbca1116b0c
Instruction ID: f952f7d9d79544cfd0ac351ac1962c202d4bfb5391b680788ff95de51101d62a
Opcode Fuzzy Hash: 368db495e192b04939e868f49799014853fb9bf12ef44e910105ddbca1116b0c
Instruction Fuzzy Hash: 1901D873301622ABCF218FB9AC449977BD89F097B1B114624F909E7140D721D982C7E0

Function 00A47464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00A4747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00A47497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00A474AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00A474CA

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 5d1a1d27bd04e626abb3482c479a6194dfcecb8c36e19ffb1e50de63867c737b
Instruction ID: 1719fb583e23b9585a300ecfc567ef3364db6bf5b416b622e7f0e123b8f400be
Opcode Fuzzy Hash: 5d1a1d27bd04e626abb3482c479a6194dfcecb8c36e19ffb1e50de63867c737b
Instruction Fuzzy Hash: CE11ADB9205350ABE720CF58DC08BAA7BFCEB80B10F10856DA61AD6191D7B0E944DBA0

Function 00A4B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00A4ACD3,?,00008000), ref: 00A4B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A4ACD3,?,00008000), ref: 00A4B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00A4ACD3,?,00008000), ref: 00A4B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A4ACD3,?,00008000), ref: 00A4B126

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 049b76aced4619a35a8fa44a51afb9cdc7cc5cd930a60c9afbf33da7c7b636c7
Instruction ID: d824ad4c9198fe5ec72113bbdecca91b10bc144f993745d758f223b5e79c08af
Opcode Fuzzy Hash: 049b76aced4619a35a8fa44a51afb9cdc7cc5cd930a60c9afbf33da7c7b636c7
Instruction Fuzzy Hash: 2E115B35C1152DE7CF04EFE8E9586EEBB78FF89721F108299D945B2181CB309691CB61

Function 00A77E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A77E33
ScreenToClient.USER32(?,?), ref: 00A77E4B
ScreenToClient.USER32(?,?), ref: 00A77E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A77E8A

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 15adc93921c5b334e3fd822cd571bc4b4d41823ab6f224207745962323f931e3
Instruction ID: ea8a348ba2ae540a561f8b6be175ede3002c34f9f002733d4fa3d1eb5238334d
Opcode Fuzzy Hash: 15adc93921c5b334e3fd822cd571bc4b4d41823ab6f224207745962323f931e3
Instruction Fuzzy Hash: AC1126B9D0024AAFDB41DF98D8849EEBBF5FF08310F509066E915E3210D735AA95CF51

Function 00A42DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00A42DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A42DD6
GetCurrentThreadId.KERNEL32 ref: 00A42DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00A42DE4

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: f188551a24d071ca18d6c5ddce3aa1245834d43fa53b4c7ec5d114dbb142a222
Instruction ID: 8b3102bb1a8d51b433ae7a3a5b4be58879466a6354e6af57c868fa3ba4824abd
Opcode Fuzzy Hash: f188551a24d071ca18d6c5ddce3aa1245834d43fa53b4c7ec5d114dbb142a222
Instruction Fuzzy Hash: 58E092716012347BD7205BB29C4DFEB7F6CEF82BB1F805119F109D10809AA4C982C7B0

Function 00A78863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 009F9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009F9693
Part of subcall function 009F9639: SelectObject.GDI32(?,00000000), ref: 009F96A2
Part of subcall function 009F9639: BeginPath.GDI32(?), ref: 009F96B9
Part of subcall function 009F9639: SelectObject.GDI32(?,00000000), ref: 009F96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00A78887
LineTo.GDI32(?,?,?), ref: 00A78894
EndPath.GDI32(?), ref: 00A788A4
StrokePath.GDI32(?), ref: 00A788B2

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: ce7f71b3a7f35caa4bbb570c25a6168bd290eb75a1578fb062af06d0b7369c21
Instruction ID: c0b1f4ea753a64c1c04486ddd0cef6564e275227c0920f15874534bf7d9f3e45
Opcode Fuzzy Hash: ce7f71b3a7f35caa4bbb570c25a6168bd290eb75a1578fb062af06d0b7369c21
Instruction Fuzzy Hash: 46F03A36041258BADB12AFD4AC0DFCA3E59AF06320F84C104FA25650E2C7795552CBE5

Function 009F98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009F98CC
SetTextColor.GDI32(?,?), ref: 009F98D6
SetBkMode.GDI32(?,00000001), ref: 009F98E9
GetStockObject.GDI32(00000005), ref: 009F98F1

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 13a91e5084303918ef6a734657d23939f983b2f6c1ddbf94c36d597dfc58cc79
Instruction ID: 590bd1a08928a4939830aa06d8f68773afa7a807d65a3648654aed4bd7b9d190
Opcode Fuzzy Hash: 13a91e5084303918ef6a734657d23939f983b2f6c1ddbf94c36d597dfc58cc79
Instruction Fuzzy Hash: 55E06531244244ABDB219BB4AC09BEC3F10AB11335F14C32DF6FA540E1C37146819B10

Function 00A4162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00A41634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00A411D9), ref: 00A4163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00A411D9), ref: 00A41648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00A411D9), ref: 00A4164F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: a33b3565d5ccd2a2fb70aad9e2d529fa536abd0b39a314b781c11f3965e1557a
Instruction ID: aeb67758015b00d04ea2126faefdba8a90c18f8f10fc90d36dc4c5c84f6dc5f1
Opcode Fuzzy Hash: a33b3565d5ccd2a2fb70aad9e2d529fa536abd0b39a314b781c11f3965e1557a
Instruction Fuzzy Hash: 71E08C36602211EBD7206FE0AE0DB867B7CAF847A6F15C81CF249DD090E63485C2CBA4

Function 00A3D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00A3D858
GetDC.USER32(00000000), ref: 00A3D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A3D882
ReleaseDC.USER32(?), ref: 00A3D8A3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 298a30643ab485183edf06ff5d135614ea23ee6e21e12ba614677c2a86156851
Instruction ID: ebdf3cb21cafc7aba86398a472e81430778384bb86e2e5abbd812f23d81d9e2a
Opcode Fuzzy Hash: 298a30643ab485183edf06ff5d135614ea23ee6e21e12ba614677c2a86156851
Instruction Fuzzy Hash: 53E01AB0800204DFCB41EFE0DC4866DBBB6FB08320F14D419F84AE7250CB385982AF40

Function 00A3D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00A3D86C
GetDC.USER32(00000000), ref: 00A3D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A3D882
ReleaseDC.USER32(?), ref: 00A3D8A3

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 20a5039097499eec90660714771f71da93801486b84cb3c953b4a46905e34c1b
Instruction ID: a99c223bda602d2b95f21838c73e19dc4f0b6f6bab440b6d966cb160aef3dc08
Opcode Fuzzy Hash: 20a5039097499eec90660714771f71da93801486b84cb3c953b4a46905e34c1b
Instruction Fuzzy Hash: 92E092B5800204EFCB51EFE1DC4866DBBB6BB48321B149459E95AE7260DB385982AF50

Function 00A54D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 009E7620: _wcslen.LIBCMT ref: 009E7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00A54ED4

Strings

LPT, xrefs: 00A54DFB
*, xrefs: 00A54E10

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 61393c2694fd41379133f3be6c8009bf0245c6248ab5281a3cbc39ad6dcc5224
Instruction ID: 42eb68295e2faf93e881e618b195806b2df78f42786874dd5418218d8da14bc5
Opcode Fuzzy Hash: 61393c2694fd41379133f3be6c8009bf0245c6248ab5281a3cbc39ad6dcc5224
Instruction Fuzzy Hash: E5917475900244AFCB15DF59C484EA9BBF1BF48708F188099F80A5F392D735ED89CB51

Function 00A0E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00A0E30D

Strings

pow, xrefs: 00A0E2E5, 00A0E302

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: c7cbc057236c19c51fd2a450cadc69d61c2540afc6183c1c457faa8f7c664d61
Instruction ID: 5c5325a9cf458a5c561d556fe86503436ac056bb0396e5ac7c3cb4ad00e05930
Opcode Fuzzy Hash: c7cbc057236c19c51fd2a450cadc69d61c2540afc6183c1c457faa8f7c664d61
Instruction Fuzzy Hash: 8F514C71A0C20A96CB15F714EA417FE3FF4AB40740F345D98E0D6862E9DB358CD2AB86

Function 009FE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 009FE1B1

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 525c121258d84325061a9001ea8e93ed8996816b47d2acdc9d2e120363f55c3a
Instruction ID: e7ed54e12593b462299934a10ba1e33db37a046e3b9442223cc9dd1ad9d917e7
Opcode Fuzzy Hash: 525c121258d84325061a9001ea8e93ed8996816b47d2acdc9d2e120363f55c3a
Instruction Fuzzy Hash: 82510675A0424ADFDB15DF68C481AFE7BA8EF55310F244059F9A19B2E0E7349D43CB90

Function 009FF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 009FF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 009FF2BB

Strings

@, xrefs: 009FF2AF

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 38eb2e0791688eeb3673dc657ea351e2a90572005c91485c1c1cec98630f49f7
Instruction ID: 4ce093df421da6885bd35fc73f7a8d4ff6382732db761260d0f62132eecccc3a
Opcode Fuzzy Hash: 38eb2e0791688eeb3673dc657ea351e2a90572005c91485c1c1cec98630f49f7
Instruction Fuzzy Hash: 8E5145714087859BD321EF51E886BABBBF8FBC4300F81885DF1D941195EB31892ACB67

Function 00A65745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00A657E0
_wcslen.LIBCMT ref: 00A657EC

Strings

CALLARGARRAY, xrefs: 00A657E6, 00A657EB

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: a525857d8611adec0758f2636cc51e8a0bb714acb9c595e5ac4a29c94916ea49
Instruction ID: 7a2b0930169768dce7d0352167ba002873a62ce6913e0b77cfd5e02eed472d5a
Opcode Fuzzy Hash: a525857d8611adec0758f2636cc51e8a0bb714acb9c595e5ac4a29c94916ea49
Instruction Fuzzy Hash: 76418C71E002099FCB14DFB9C9819FEBBB5FF99320F108069E505A72A2E7309D81DB90

Function 00A5D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A5D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00A5D13A

Strings

|, xrefs: 00A5D10B

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 966df34e020427613a971db2a06341433583d24e4185fdc7a59ca3115239a375
Instruction ID: 3bf9afbe2c225ea99f8bdb5d1ebed90005a3e39ff961ccbeb233cb00501eed12
Opcode Fuzzy Hash: 966df34e020427613a971db2a06341433583d24e4185fdc7a59ca3115239a375
Instruction Fuzzy Hash: B8314F71D00209ABCF15EFA5CC85EEE7FB9FF55340F000159F815A6162EB31AA56CB60

Function 00A7356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00A73621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00A7365C

Strings

static, xrefs: 00A735BC

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: e24862db2d6fe218a039035bcf2244501872f3fdfc1576ebf8e8a78bd202eaca
Instruction ID: 66e7881ded4f94392ae1e3f5bd52ba5535f2a3077af7004b30df07d6eb891e5b
Opcode Fuzzy Hash: e24862db2d6fe218a039035bcf2244501872f3fdfc1576ebf8e8a78bd202eaca
Instruction Fuzzy Hash: 8F318B72100204AEDB10DF68DC80FBB73A9FF88720F11D619F9A997290DA31AD82D764

Function 00A74537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00A7461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A74634

Strings

', xrefs: 00A7458E

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: e062126f21f89b9c42bbb6a566528c3b1aa059291b183ba1d02979ef61397024
Instruction ID: 1b54118a6051121f3e8ada036c63c48ff8718d11b73f4b51c9d354ddf06d277e
Opcode Fuzzy Hash: e062126f21f89b9c42bbb6a566528c3b1aa059291b183ba1d02979ef61397024
Instruction Fuzzy Hash: AB31F874A013099FDB14CFA9C991BDA7BB5FF49300F14816AE909AB351E770E941CF90

Function 00A731EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00A7327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A73287

Strings

Combobox, xrefs: 00A73249

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: e22308ad707bb9089c33c257b92d8fadf5f5035295b429d78aa65d5ec70c1637
Instruction ID: 1447ebe4db147440a375f41e062142bc3ee5a15d0689d9238437ea8249a81c1a
Opcode Fuzzy Hash: e22308ad707bb9089c33c257b92d8fadf5f5035295b429d78aa65d5ec70c1637
Instruction Fuzzy Hash: 2311B6723001087FEF219F94DC84EFB376AEBA8364F11C528F51C97291D6759D5197A0

Function 00A73710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 009E600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009E604C
Part of subcall function 009E600E: GetStockObject.GDI32(00000011), ref: 009E6060
Part of subcall function 009E600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 009E606A

GetWindowRect.USER32(00000000,?), ref: 00A7377A
GetSysColor.USER32(00000012), ref: 00A73794

Strings

static, xrefs: 00A73757

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: acde19ea40da91b650b0a1ca322381a64dbded177938162c05bfaa248112be41
Instruction ID: d7fd8bbf7f5ded9f2a5782c04e98bd72bc76fc2dcb54a9decbe11910f1b687ba
Opcode Fuzzy Hash: acde19ea40da91b650b0a1ca322381a64dbded177938162c05bfaa248112be41
Instruction Fuzzy Hash: C31129B2610209AFDF01DFA8CC45EEA7BB8FB08355F018918F959E2250D735E8519B50

Function 00A5CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00A5CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00A5CDA6

Strings

<local>, xrefs: 00A5CD66

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: f07351a1c6e69921210002d1f36174dc22dcc27756bcf2ce668c7f5933dc0dde
Instruction ID: b45641e1c9d0b291fa5110d96254b387d08720e604f4a4bed80e75890e6790ce
Opcode Fuzzy Hash: f07351a1c6e69921210002d1f36174dc22dcc27756bcf2ce668c7f5933dc0dde
Instruction Fuzzy Hash: 16119E72205735BED7284B668C49FE7BEB8FB127B6F00422AB909C2084D6749949D6F0

Function 00A73429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00A734AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00A734BA

Strings

edit, xrefs: 00A7348F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: fbc6cf8e1f765fea7e18044b9446e6e06fcc6e99268de5cf1be752d73acdeddd
Instruction ID: 741b3a8e7b39801d5afd957a3b486ceff6f8ea61fb4333fb3b524e32198421ec
Opcode Fuzzy Hash: fbc6cf8e1f765fea7e18044b9446e6e06fcc6e99268de5cf1be752d73acdeddd
Instruction Fuzzy Hash: 0011BF72100108ABEF168FA4DC84ABB376AEB14775F51C724FA69931E0C736DC91A750

Function 00A46C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00A46CB6
_wcslen.LIBCMT ref: 00A46CC2

Strings

STOP, xrefs: 00A46CBC, 00A46CC1

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 60bfb3960d2ef5839592362489980d6f7bba1507bfc11e92e6aa08173f9fd1d8
Instruction ID: ba27798c32ce3c89a18402f0ed19d6ab528bcf5463a5628f56ad84920bae4a74
Opcode Fuzzy Hash: 60bfb3960d2ef5839592362489980d6f7bba1507bfc11e92e6aa08173f9fd1d8
Instruction Fuzzy Hash: E101C036A009268ACB21AFBDDC809BF77B5EFE67147500928E86297190EB31DD40C651

Function 00A41CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A43CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00A41D4C

Strings

ComboBox, xrefs: 00A41CEB
ListBox, xrefs: 00A41D16

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: bc081684504eb79b5aad624eef5f32bb6ce8d59b633184b0df6d846485288b3c
Instruction ID: 7f10e0423b29cbc0f2e655f37361ffc77d8f1e22813616869a587a474d7b1549
Opcode Fuzzy Hash: bc081684504eb79b5aad624eef5f32bb6ce8d59b633184b0df6d846485288b3c
Instruction Fuzzy Hash: AE012879A00214ABCF14FFA0CD51DFE73A8FB82350B500909F862572D1EA305D488660

Function 00A41BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A43CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00A41C46

Strings

ComboBox, xrefs: 00A41BE5
ListBox, xrefs: 00A41C10

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 86bce11c18458b325fd193ba1a5e9862da088e428cf75176c780755aab0f502f
Instruction ID: 3073c0a59dda2d0975139edbab9af6f0cbdedfbc01c5bb4feee3635dec2db5ca
Opcode Fuzzy Hash: 86bce11c18458b325fd193ba1a5e9862da088e428cf75176c780755aab0f502f
Instruction Fuzzy Hash: E501A779A8111876CF15FBA0CE91AFF77A89B92340F140419A806672C1FA649E4C86B1

Function 00A41C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A43CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00A41CC8

Strings

ComboBox, xrefs: 00A41C69
ListBox, xrefs: 00A41C94

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: df78a53e7188883cb358f356b31102b211565c06b3e30a7474b3eb51e7d4f26e
Instruction ID: 4ab8372d49430d1a4b487008a94f60efd68211ebbe4c2e20f615abc0e73ce3c1
Opcode Fuzzy Hash: df78a53e7188883cb358f356b31102b211565c06b3e30a7474b3eb51e7d4f26e
Instruction Fuzzy Hash: E401D679A8011877CF15FBA1CF81BFE73A8AB92340F540419B80673281FA609F59C671

Function 00A41D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A43CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00A41DD3

Strings

ComboBox, xrefs: 00A41D75
ListBox, xrefs: 00A41DA0

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 8f9fc8ab385c6e9b9b2c35f6d62dc59f1f2e4bdf046ad0050a39a9580d2592c5
Instruction ID: aa8afa3720320391ca3720ac835dc3f3d2910d458f0ba3a82e5928ccbdd7fd8e
Opcode Fuzzy Hash: 8f9fc8ab385c6e9b9b2c35f6d62dc59f1f2e4bdf046ad0050a39a9580d2592c5
Instruction Fuzzy Hash: 1AF0F4B5F4021476CB14F7A4CD92BFE73B8AB82350F040D19B822632C1EA605D488260

Function 00A6747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A67493
_wcslen.LIBCMT ref: 00A674B9

Strings

3, 3, 16, 1, xrefs: 00A67483

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: f3a750d1ddeede7f316a46dfba17053cbdf0951260562bdce4bad2e498462a10
Instruction ID: d729539b207442a706d549d822f38aa6ec80b949e6e8cf2cf595d888cb2ebf7c
Opcode Fuzzy Hash: f3a750d1ddeede7f316a46dfba17053cbdf0951260562bdce4bad2e498462a10
Instruction Fuzzy Hash: 71E02B8222522020D2311379ADCDA7F5699EFC9B90710183BFE81C22A6EE948D9193A0

Function 00A40B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00A40B23

Strings

AutoIt, xrefs: 00A40B17
Error allocating memory., xrefs: 00A40B1C

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 36c7ca0fd42e24d970325ba990b78b22edca1b1e8afe23943ccb7cad92c92d59
Instruction ID: ed06d241ba24fa434985f0e2c1f13be10123826baa900ff1e53fd3beebd3a148
Opcode Fuzzy Hash: 36c7ca0fd42e24d970325ba990b78b22edca1b1e8afe23943ccb7cad92c92d59
Instruction Fuzzy Hash: 99E0D83224430C36D21437947C03F897B849F05B60F10842EF78C994C38BE2249006AD

Function 00A00D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009FF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00A00D71,?,?,?,009E100A), ref: 009FF7CE

IsDebuggerPresent.KERNEL32(?,?,?,009E100A), ref: 00A00D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,009E100A), ref: 00A00D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00A00D7F

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 374ad44d4f440aa783c315d926045867e3ebe24e330fe25e4f2a38a5e039b27d
Instruction ID: 28caf773c401a516f411f494cd67294256e920299eb05c5544f0adaf2460dcc3
Opcode Fuzzy Hash: 374ad44d4f440aa783c315d926045867e3ebe24e330fe25e4f2a38a5e039b27d
Instruction Fuzzy Hash: 5FE06D702007418FD370EFB8E8047427BE4AF00740F00C92DE48AC7692EBB0E5858BA1

Function 00A53017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00A5302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00A53044

Strings

aut, xrefs: 00A53038

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 8041c370e7c797c14312be3a65308121f7310452ba2914ddccc67b3323bf0264
Instruction ID: ca11047b1a6add569dd5d9b13bf21e9224f42d8e135f0f2a8e0b87b6a3b7dac6
Opcode Fuzzy Hash: 8041c370e7c797c14312be3a65308121f7310452ba2914ddccc67b3323bf0264
Instruction Fuzzy Hash: 02D05E7250032877DB20E7E4AC0EFDB3A6CDB05760F0006A1B659E20D2DAB09A85CBD0

Function 00A3D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00A3D220

Strings

X64, xrefs: 00A3D2A8
%.3d, xrefs: 00A3D22B

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: a693f53df77d500eecc9dc304f53cf4a6345229595c85ad844439c6d131fda7e
Instruction ID: 43c68d97246a071616b4cc16adb9144e6adcba606ee11f4adb0bf0fe5ca07efd
Opcode Fuzzy Hash: a693f53df77d500eecc9dc304f53cf4a6345229595c85ad844439c6d131fda7e
Instruction Fuzzy Hash: 8DD012B1809108E9CF9096D0EC459FBB37CBF08301F608462F90AE2041D634C5486761

Function 00A72322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A7232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00A7233F

Part of subcall function 00A4E97B: Sleep.KERNELBASE ref: 00A4E9F3

Strings

Shell_TrayWnd, xrefs: 00A72325

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 0652d738cdbccfa3bf5fbb85e6406b514311e9cd4d4516350e7206f7ba40416d
Instruction ID: 2036cb254a87da7906587e741be2fbc442781540a6aec83e6b1ef1d97f63293e
Opcode Fuzzy Hash: 0652d738cdbccfa3bf5fbb85e6406b514311e9cd4d4516350e7206f7ba40416d
Instruction Fuzzy Hash: 2BD012363D4310B7E664F7B0DC4FFC6BA14AB40B21F00891AB749AA1D1CAF4A842CE54

Function 00A72356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A7236C
PostMessageW.USER32(00000000), ref: 00A72373

Part of subcall function 00A4E97B: Sleep.KERNELBASE ref: 00A4E9F3

Strings

Shell_TrayWnd, xrefs: 00A72365

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 2ee7fcd2a6b3c12bad25c2ca777486b6805b3eb4d48ba14ca2358a8bd5b91b3a
Instruction ID: 3f7c3ddb5d9ac12c51d16564a77002dfe1e85de8257a7ea2d68e6e56a28e0959
Opcode Fuzzy Hash: 2ee7fcd2a6b3c12bad25c2ca777486b6805b3eb4d48ba14ca2358a8bd5b91b3a
Instruction Fuzzy Hash: F8D0C9363D1310BAE664E7B09C4FFC6A614AB45B21F00891AB649AA1D1CAA4A8428A54

Function 00A1BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00A1BE93
GetLastError.KERNEL32 ref: 00A1BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A1BEFC

Memory Dump Source

Source File: 00000000.00000002.2946269082.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2946234938.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000A7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946348097.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946405977.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2946448141.0000000000AB4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 5b87215eabfaaad95f2d18c68ef559766c419647c93d7670abed1a3bf079eebf
Instruction ID: c897ac6eed1247203dcc124e1369c7fa630c9f7e612ca759f50d0867f016db63
Opcode Fuzzy Hash: 5b87215eabfaaad95f2d18c68ef559766c419647c93d7670abed1a3bf079eebf
Instruction Fuzzy Hash: 3541B134614206AFDF21CFA5DD44AEABBB9AF41320F244169F9599B1E1DB30CD82CB70

Source: Joe Sandbox View	IP Address: 23.200.0.42 23.200.0.42
Source: Joe Sandbox View	IP Address: 13.107.246.64 13.107.246.64
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60

Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726243459&P2=404&P3=2&P4=QwEpe5bNAxRqis2OzLyOwZbb2szEumdt6elz3rYqvtGJFp8KEUK1zYK8sQmRTfjuzuCjgH2LSw0KWC69NW0Nrg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: r05OsiYe9/ezUJqZgkLJRASec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zaUmEH16xoFD+E8&MD=BaKEbXEc HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726243459&P2=404&P3=2&P4=QwEpe5bNAxRqis2OzLyOwZbb2szEumdt6elz3rYqvtGJFp8KEUK1zYK8sQmRTfjuzuCjgH2LSw0KWC69NW0Nrg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: r05OsiYe9/ezUJqZgkLJRASec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zaUmEH16xoFD+E8&MD=BaKEbXEc HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.165.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.165.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.165.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.165.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.165.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.165.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.165.132
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.165.132
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.185.164

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\323233f7-c9f1-4a03-bc94-420094230f9a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3826f2d0-ffd9-4c74-afb3-7d833b722f7f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3e5f9d6d-66a2-4264-a282-fa16cef2b738.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4484b8d5-4ea8-4b62-98a0-48304dfc0f70.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\474df136-85e3-432b-98ae-ea62a778e083.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4dd67b63-05c5-47b8-b468-8425023922da.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4fd11db7-7b54-4a3f-9e94-3b3fd09c67f9.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5fcb34aa-f7de-4243-b02a-ab2362ce19fd.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8ca877fd-0e19-4efd-992f-57ca9290e34c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8daebccf-e1c9-47df-b602-84fc2d8f9b23.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\68cce5a7-3928-4137-be06-ce9796ebfc31.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66DB27EF-1978.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66DB27EF-AF0.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre