Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1500132
MD5:	1d84aa5d8aecd53e1567aadd7df1c13d
SHA1:	ad3162953d9c1d36ef6adca6cccdead69837288e
SHA256:	c96e16b28bb66cb0c704a42586406cada702367b0258eba93739c40f13a17c4b
Tags:	exe
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7508 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1D84AA5D8AECD53E1567AADD7DF1C13D)

msedge.exe (PID: 7524 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7772 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2092,i,8600603416719304187,13124135000556718685,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7784 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8096 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2780 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8948 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3440 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8956 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6624 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9032 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9052 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 7596 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9140 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2828 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4504 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9500 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9508 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9924 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 10140 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2080,i,12276315418362096745,837987365199203899,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7324 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8872 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2060,i,2702299294665061934,3123755866690733270,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9668 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9904 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2052,i,11272247715106143866,5476800878713775811,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.2934486749.00000000011DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2934486749.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.12.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.12.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.12.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: a54b5550-4a2f-444c-ad82-3de259bad45f.tmp.13.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.12.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: a54b5550-4a2f-444c-ad82-3de259bad45f.tmp.13.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.12.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: content.js.12.dr, content_new.js.12.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: a54b5550-4a2f-444c-ad82-3de259bad45f.tmp.13.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 52743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52736
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52739
Source: unknown	Network traffic detected: HTTP traffic on port 52739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52740
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52743
Source: unknown	Network traffic detected: HTTP traffic on port 52738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52744
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 52745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:52743 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D3EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00D3EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D3ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00D3ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_00D3EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D2AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00D2AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D59576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00D59576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_156eb34a-c
Source: file.exe, 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_b946406f-d
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c39bc8f7-6
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_a5dbc9aa-9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D2D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00D2D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D21201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00D21201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D2E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00D2E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D32046	0_2_00D32046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC8060	0_2_00CC8060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D28298	0_2_00D28298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE4FF	0_2_00CFE4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF676B	0_2_00CF676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D54873	0_2_00D54873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CCCAF0	0_2_00CCCAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CECAA0	0_2_00CECAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDCC39	0_2_00CDCC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF6DD9	0_2_00CF6DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC91C0	0_2_00CC91C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDB119	0_2_00CDB119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE1394	0_2_00CE1394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE1706	0_2_00CE1706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE781B	0_2_00CE781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE19B0	0_2_00CE19B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD997D	0_2_00CD997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC7920	0_2_00CC7920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE7A4A	0_2_00CE7A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE7CA7	0_2_00CE7CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE1C77	0_2_00CE1C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF9EEE	0_2_00CF9EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4BE44	0_2_00D4BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE1F32	0_2_00CE1F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00CE0A30 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00CDF9F2 appears 31 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.evad.winEXE@96/525@20/11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D337B5 GetLastError,FormatMessageW,

0_2_00D337B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D210BF AdjustTokenPrivileges,CloseHandle,		0_2_00D210BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D216C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00D216C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D351CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00D351CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D4A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00D4A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D3648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00D3648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00CC42A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\962ad31a-c3f9-49c7-97a1-1d12169e706e.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.12.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2092,i,8600603416719304187,13124135000556718685,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2780 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3440 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6624 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4504 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2080,i,12276315418362096745,837987365199203899,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2060,i,2702299294665061934,3123755866690733270,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2052,i,11272247715106143866,5476800878713775811,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2092,i,8600603416719304187,13124135000556718685,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2780 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3440 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6624 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4504 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2080,i,12276315418362096745,837987365199203899,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2060,i,2702299294665061934,3123755866690733270,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2052,i,11272247715106143866,5476800878713775811,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00CC42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE0A76 push ecx; ret

0_2_00CE0A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00CDF98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D51C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00D51C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-96118

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6494

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.4 %

Source: C:\Users\user\Desktop\file.exe TID: 7512	Thread sleep count: 6494 > 30			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7512	Thread sleep time: -64940s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6494 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00D2DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D368EE FindFirstFileW,FindClose,	0_2_00D368EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00D3698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00D2D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00D2D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D39642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D39642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D3979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D39B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00D39B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D35C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00D35C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00CC42DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-96026

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D3EAA2 BlockInput,

0_2_00D3EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CF2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00CF2622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00CC42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE4CE8 mov eax, dword ptr fs:[00000030h]

0_2_00CE4CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D20B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00D20B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00CF2622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00CE083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE09D5 SetUnhandledExceptionFilter,	0_2_00CE09D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00CE0C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00D21201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D02BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00D02BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D2B226 SendInput,keybd_event,

0_2_00D2B226

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D422DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00D422DA

Source: C:\Users\user\Desktop\file.exe

0_2_00D20B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D21663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00D21663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE0698 cpuid

0_2_00CE0698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D38195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00D38195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D1D27A GetUserNameW,

0_2_00D1D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CFBB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00CFBB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00CC42DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D41204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00D41204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D41806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00D41806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://clients2.googleusercontent.com/crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.184.193	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.12.dr	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.12.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://msn.com	data_10.5.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.12.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.5.dr	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content.js.12.dr, content_new.js.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	a54b5550-4a2f-444c-ad82-3de259bad45f.tmp.13.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
172.253.63.84	unknown	United States	15169	GOOGLEUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.40.110	unknown	United States	15169	GOOGLEUS	false
142.250.65.228	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500132
Start date and time:	2024-08-28 00:03:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@96/525@20/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 41 Number of non-executed functions: 309
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.110.84, 13.107.42.16, 204.79.197.239, 13.107.21.239, 13.107.6.158, 2.22.242.105, 2.22.242.11, 172.217.18.3, 142.250.74.195, 2.23.209.177, 2.23.209.185, 2.23.209.187, 2.23.209.140, 2.23.209.130, 2.23.209.179, 2.23.209.182, 20.24.121.134, 93.184.221.240, 192.229.221.95, 142.250.186.142, 142.250.185.202, 142.250.186.74, 142.250.74.202, 142.250.186.138, 142.250.185.106, 216.58.212.170, 142.250.185.74, 142.250.185.138, 142.250.184.234, 142.250.185.234, 142.250.184.202, 172.217.18.106, 216.58.206.74, 142.250.181.234, 142.250.186.170, 142.250.185.170, 142.250.64.99, 142.250.80.99, 142.250.72.99, 142.250.65.195, 142.250.81.227, 142.251.35.163
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, dns.msftncsi.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, iris-de-prod-azsc-v2-eas.eastasia.cloudapp.azure.com, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azur
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
23:04:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
23:04:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
23:04:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
23:04:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	San Xavier District of the Tohono O#U2019odham Nation.pdf	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	DOC-71275297.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	DOC-80697077.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	Madisonwellsmedia546.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://12dec6c2-3c78-e425-b87e-b20197f5da10.powerappsportals.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://esc-dot-wind-blade-416540.uk.r.appspot.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://email-10.moengage.com/v1/emailclick?q=J9hmu1r6QKZrUydA7M0LhmLQ5i7Dg0Nl6MHK33dlRRiHDGLaUmrV29w-y9KVmRzhTLgNQhsm45GxW8V8xKrQoKNDHjB7CRmg_1cweH.uPLe.3eHt_gc8HUYJyNafgEERmJL2LxAT8X7OcG6eGtfAfBO9PAxgYyMwORkMW2Shu_8EgxVomZ4n5YVrJ6BeKFaCmD6d2Q4-0na_EglsL0Brj6yR2v6QG0HeFNJCVHWIDqcMyqe_r88-cETjiVnbQ8n6AdsU8zQ3H7iztnEZXRzETHYdGTm5hvYgsr5Sg7bkrF81eht6fM_e-ibIZP2oMLvBT1zWn_xe_wasEim1gTvVJRTqev1AuuHjN-EARFMZfriSXRqAx2EgGZLcoc2EiPI4kOQISdubWyzK9Xtj10aCP_wAt6KxwJRnrrWNRvn3blBJWnngxtQFXjDGd_qwCgdLvQwPLy5R0skEjnG0HC7MA#V2xjMVEyVlhTWHBSYlhocVRVVktkbGRXWkRSak1XdDVUMVJHYVdKc1NURlVSekExWlZad00xQlVNRDA9	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://newbostondentalcare-my.sharepoint.com/:b:/g/personal/maryellen_newbostondental_com/ERDvxS5UJSxPtXyWuklCyAMBDYWal6mJXrTJHUf_OfHqfg?e=5l0sTu	Get hash	malicious	Phisher	Browse	172.67.215.161
	https://bx1f04.na1.hubspotlinks.com/Ctc/2D+113/bX1F04/VWNJB36hmH_dW5B6f4M3tvNPkW6wcfC_5kfpqkN8pR4CT3qn9gW8wLKSR6lZ3lWW4RH0pD8cfc9fW1F_Bh_64Dbx_W8NP5442K_JLsW7VR2DZ6lXzbTW28cFfX9gXt3BW7kls0H2y2hq_W3ngTnJ28DTx_W6DvQHq8CwpszW2lLgbg3Q_MrpW2nSqGh8-5CjqW8mVvJw37-m1FW7tfJZm8wSKY9W920ndF61Cm7DW9fdnsh4qV1mzW6pLzrc94r10SW7SD62m3Qvv5jW87mYgh1YRjnYVKpmxr6B_xWTW3fp6Zx8jLGfWW7jL-y0457X8VN1TltTwsBPcYW7WJ-FL8qLjSdW7qm5WN8GZBkfW95bMcn6zJPqCVf27963J_4FxV1TfBP8XznlQW4GzPL-176L_NW72HRpV192F4df1YJ3TM04	Get hash	malicious	Unknown	Browse	104.16.160.168
	is it legal to kill a peacock in california 93889.js	Get hash	malicious	GookitLoader	Browse	188.114.96.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	http://ketoryyby.cloud	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.gxtfinance.com/english.php	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
CLOUDFLARENETUS	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://newbostondentalcare-my.sharepoint.com/:b:/g/personal/maryellen_newbostondental_com/ERDvxS5UJSxPtXyWuklCyAMBDYWal6mJXrTJHUf_OfHqfg?e=5l0sTu	Get hash	malicious	Phisher	Browse	172.67.215.161
	https://bx1f04.na1.hubspotlinks.com/Ctc/2D+113/bX1F04/VWNJB36hmH_dW5B6f4M3tvNPkW6wcfC_5kfpqkN8pR4CT3qn9gW8wLKSR6lZ3lWW4RH0pD8cfc9fW1F_Bh_64Dbx_W8NP5442K_JLsW7VR2DZ6lXzbTW28cFfX9gXt3BW7kls0H2y2hq_W3ngTnJ28DTx_W6DvQHq8CwpszW2lLgbg3Q_MrpW2nSqGh8-5CjqW8mVvJw37-m1FW7tfJZm8wSKY9W920ndF61Cm7DW9fdnsh4qV1mzW6pLzrc94r10SW7SD62m3Qvv5jW87mYgh1YRjnYVKpmxr6B_xWTW3fp6Zx8jLGfWW7jL-y0457X8VN1TltTwsBPcYW7WJ-FL8qLjSdW7qm5WN8GZBkfW95bMcn6zJPqCVf27963J_4FxV1TfBP8XznlQW4GzPL-176L_NW72HRpV192F4df1YJ3TM04	Get hash	malicious	Unknown	Browse	104.16.160.168
	is it legal to kill a peacock in california 93889.js	Get hash	malicious	GookitLoader	Browse	188.114.96.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	http://ketoryyby.cloud	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.gxtfinance.com/english.php	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	20.96.153.111
	https://newbostondentalcare-my.sharepoint.com/:b:/g/personal/maryellen_newbostondental_com/ERDvxS5UJSxPtXyWuklCyAMBDYWal6mJXrTJHUf_OfHqfg?e=5l0sTu	Get hash	malicious	Phisher	Browse	52.98.177.2
	https://bx1f04.na1.hubspotlinks.com/Ctc/2D+113/bX1F04/VWNJB36hmH_dW5B6f4M3tvNPkW6wcfC_5kfpqkN8pR4CT3qn9gW8wLKSR6lZ3lWW4RH0pD8cfc9fW1F_Bh_64Dbx_W8NP5442K_JLsW7VR2DZ6lXzbTW28cFfX9gXt3BW7kls0H2y2hq_W3ngTnJ28DTx_W6DvQHq8CwpszW2lLgbg3Q_MrpW2nSqGh8-5CjqW8mVvJw37-m1FW7tfJZm8wSKY9W920ndF61Cm7DW9fdnsh4qV1mzW6pLzrc94r10SW7SD62m3Qvv5jW87mYgh1YRjnYVKpmxr6B_xWTW3fp6Zx8jLGfWW7jL-y0457X8VN1TltTwsBPcYW7WJ-FL8qLjSdW7qm5WN8GZBkfW95bMcn6zJPqCVf27963J_4FxV1TfBP8XznlQW4GzPL-176L_NW72HRpV192F4df1YJ3TM04	Get hash	malicious	Unknown	Browse	150.171.28.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	DOC-71275297.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	DOC-80697077.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	San Xavier District of the Tohono O#U2019odham Nation.pdf	Get hash	malicious	Unknown	Browse	52.108.66.1
	San Xavier District of the Tohono O#U2019odham Nation.pdf	Get hash	malicious	Unknown	Browse	52.108.66.1
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
EDGECASTUS	https://bx1f04.na1.hubspotlinks.com/Ctc/2D+113/bX1F04/VWNJB36hmH_dW5B6f4M3tvNPkW6wcfC_5kfpqkN8pR4CT3qn9gW8wLKSR6lZ3lWW4RH0pD8cfc9fW1F_Bh_64Dbx_W8NP5442K_JLsW7VR2DZ6lXzbTW28cFfX9gXt3BW7kls0H2y2hq_W3ngTnJ28DTx_W6DvQHq8CwpszW2lLgbg3Q_MrpW2nSqGh8-5CjqW8mVvJw37-m1FW7tfJZm8wSKY9W920ndF61Cm7DW9fdnsh4qV1mzW6pLzrc94r10SW7SD62m3Qvv5jW87mYgh1YRjnYVKpmxr6B_xWTW3fp6Zx8jLGfWW7jL-y0457X8VN1TltTwsBPcYW7WJ-FL8qLjSdW7qm5WN8GZBkfW95bMcn6zJPqCVf27963J_4FxV1TfBP8XznlQW4GzPL-176L_NW72HRpV192F4df1YJ3TM04	Get hash	malicious	Unknown	Browse	152.199.22.144
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	San Xavier District of the Tohono O#U2019odham Nation.pdf	Get hash	malicious	Unknown	Browse	93.184.221.240
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	http://www.coredc.com	Get hash	malicious	Unknown	Browse	152.199.22.144
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	Madisonwellsmedia546.pdf	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://t.co/CFNobJuJq9	Get hash	malicious	HTMLPhisher	Browse	93.184.221.165
	http://esc-dot-wind-blade-416540.uk.r.appspot.com	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	Status Update ECKY2.html	Get hash	malicious	Unknown	Browse	152.199.21.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://dakvm1hb16unn.cloudfront.net/907GFfC/P6HE/screenpresso-6628595676980865-AsystentPobierania.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://bx1f04.na1.hubspotlinks.com/Ctc/2D+113/bX1F04/VWNJB36hmH_dW5B6f4M3tvNPkW6wcfC_5kfpqkN8pR4CT3qn9gW8wLKSR6lZ3lWW4RH0pD8cfc9fW1F_Bh_64Dbx_W8NP5442K_JLsW7VR2DZ6lXzbTW28cFfX9gXt3BW7kls0H2y2hq_W3ngTnJ28DTx_W6DvQHq8CwpszW2lLgbg3Q_MrpW2nSqGh8-5CjqW8mVvJw37-m1FW7tfJZm8wSKY9W920ndF61Cm7DW9fdnsh4qV1mzW6pLzrc94r10SW7SD62m3Qvv5jW87mYgh1YRjnYVKpmxr6B_xWTW3fp6Zx8jLGfWW7jL-y0457X8VN1TltTwsBPcYW7WJ-FL8qLjSdW7qm5WN8GZBkfW95bMcn6zJPqCVf27963J_4FxV1TfBP8XznlQW4GzPL-176L_NW72HRpV192F4df1YJ3TM04	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	DOC-71275297.pdf	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	https://2n8w.app.link/?~channel=Email&~feature=ConfirmationEmail--BenerailETicket&~campaign=WebToApp&~tags=locale%3Dnl_NL&~tags=version%3D1&~tags=marketing_code%3DBSH3675&$android_url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.thetrainline%26hl%3Dnl-NL&$android_deepview=false&$android_passive_deepview=false&$ios_url=https%3A%2F%2Fitunes.apple.com%2FNL%2Fapp%2Fthetrainline%2Fid334235181&$ios_deepview=false&$ios_passive_deepview=false&$fallback_url=//pub-f6244fe9c7374698a595b626f3787308.r2.dev/serverDCCCCCCC.html#mhebert@vib.tech	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	DOC-80697077.pdf	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	infected.html	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	infected.html	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2956
Entropy (8bit):	5.590273694686246
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afgWmpaydAzudeYkHB+I+drxyvBQjsoGzRf6bfaJkXMc/Fwlt:Xq8NkC1fgWuxcBEgvujsoQfcSJkcc/y3
MD5:	1E56B7A9D33A7BD03C4EEE45A221612A
SHA1:	EC70BC87839F98D58B344D0AE2D29A1271E7BDA3
SHA-256:	2A0F81DC0C18BC08BB5BCED67A493B16742B71E723321B2139E0D0AD9FF815A3
SHA-512:	D2B7374FD11C0F479420F2B29945C3230AC497C45E0D69A90592EA03F0CA791A979EF0AD95D853C5C3EEB6AE37505580DCC8A7A61AFC1D84E28338F7391F6AB2
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"policy":{"last_statistics_update":"13369269838052598"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\350915e4-ce30-462e-b1b5-e47d0a101e53.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3333
Entropy (8bit):	5.6136499660672365
Encrypted:	false
SSDEEP:	96:0q8NkC1fgWuxaqBEgvujsox+oJkcc/USDS4S4SDSL8I4a:/8Nb6WYXox+Ikc+d
MD5:	3D982CAC38080837D9C131BF69EC3827
SHA1:	34487F3D0CD1A6F9C9059DB12B6868DABDA29FE2
SHA-256:	3F48006D01F7E349FC51A8183F1F8D85BD60596EDAE1EEB188B092A1D8EAA15C
SHA-512:	0398DD5125984A5393A58CE7BF96AB8889B49767F5BB171CC2B2171F1DD5BD6EE146CE395D9F0F06370E34D3213050FFB3C09F84A19C3E681933809C88334367
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4c96a09a-177b-42fa-8dd1-89dd5ec6370f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2956
Entropy (8bit):	5.590273694686246
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afgWmpaydAzudeYkHB+I+drxyvBQjsoGzRf6bfaJkXMc/Fwlt:Xq8NkC1fgWuxcBEgvujsoQfcSJkcc/y3
MD5:	1E56B7A9D33A7BD03C4EEE45A221612A
SHA1:	EC70BC87839F98D58B344D0AE2D29A1271E7BDA3
SHA-256:	2A0F81DC0C18BC08BB5BCED67A493B16742B71E723321B2139E0D0AD9FF815A3
SHA-512:	D2B7374FD11C0F479420F2B29945C3230AC497C45E0D69A90592EA03F0CA791A979EF0AD95D853C5C3EEB6AE37505580DCC8A7A61AFC1D84E28338F7391F6AB2
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"policy":{"last_statistics_update":"13369269838052598"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5fc38298-c324-4aa2-9e01-6d664005f7e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.064746049049382
Encrypted:	false
SSDEEP:	384:LtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaV8NBSLAtWFTcu00jGX4KXH:hM7X2zt1jKYqHkZeM/RFTcu034K3
MD5:	4E27B2A174D4E916FD37F70FD14E1A6A
SHA1:	CFB2CAC0D355146AA937F954D49CFE66A1DCE91F
SHA-256:	743C7FFB94DBC282A35DCD3ED3AA45360D07D2DCC3C690113908BF7E0E62B14C
SHA-512:	FC4A3740AC9892FFF41E351DB128048ADA550E277AAE9B8618D97802B817CD7E77BCAC2D7D3F944AC47285D413F92ABB47F2C11C50B10C9708828C4D63584D5B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369269840385842","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8dc42786-92e1-4d74-bc09-b035aa24ce51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4233
Entropy (8bit):	5.49999623995596
Encrypted:	false
SSDEEP:	96:0q8NkGS1fgWux58rh/cI9URoDotoH+BEgvujsox+oJkcc/USDS4S4SDSL8I4a:/8NBS6WbeoDU5Xox+Ikc+d
MD5:	90AAA230303D61EA29039519882B13A7
SHA1:	2EDE5FB656B55447B94C076F64EA0D25D217B69B
SHA-256:	63FCDF229353E226BEB58CC4EF5931CE2DC7E04EC601343EA25B7C434F08564C
SHA-512:	FF95D3FED9AF3B26957CE77FDE1663765A6381ACDD2534ECE01536828A4DFB6A3AC4EC738F9CBDD0AAB576E21E713A3D5AA66F0C4A7047AB4402EFBAC9F612B8
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUb

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\b8c64817-1fc6-405f-bd9b-187263417804.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139867263744
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
MD5:	515BFDD0A8E03F491ED66894DAC7434B
SHA1:	00534E56EA194556D8E48772D2463BB291B567AC
SHA-256:	C76D8691C06568DE0108BAD3E4C5596E5B6DB4AF6864E0C4B57F3EE2C909FA18
SHA-512:	649D4F9FF7446C1DB4B16F6A4C9BEBF0A92A9E266898D653A11CBC44FCCDE8472D91758A624AA5D5A1B306DFA793E5F72370ED70514CB25312B76ACD605EA652
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139867263744
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
MD5:	515BFDD0A8E03F491ED66894DAC7434B
SHA1:	00534E56EA194556D8E48772D2463BB291B567AC
SHA-256:	C76D8691C06568DE0108BAD3E4C5596E5B6DB4AF6864E0C4B57F3EE2C909FA18
SHA-512:	649D4F9FF7446C1DB4B16F6A4C9BEBF0A92A9E266898D653A11CBC44FCCDE8472D91758A624AA5D5A1B306DFA793E5F72370ED70514CB25312B76ACD605EA652
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66CE4D4D-1D64.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.040495634366966404
Encrypted:	false
SSDEEP:	192:zzUjLYiVWK+ggCdlRJtD+FX9XlokgV8v4MhlwNE1bcRQM9noKn8y08Tcm2RGOdB:PUjjllqY0hacQhoK08T2RGOD
MD5:	6496BAA6A72110722F4E6DD53EEFEDEE
SHA1:	332A70E5AA68A957DD9B5541F770C98F51E9A178
SHA-256:	28F4260EC65E3132321AAEDA569099A5768DF11757A642A3112A2993616268B6
SHA-512:	0EAD2D57A47805545E08248D807C99DD01811E3F36AD8CEFB2B094FE88FDD22D2B7CD96A2532AA1EA8FD40D8D5DB8E21E1842CEB3407E921B208B5A8428A86EA
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".sssfol20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z.......Q8W@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66CE4D4E-1E68.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4573664671265781
Encrypted:	false
SSDEEP:	3072:WJny+VFL5S/MqdxZYzMRbbin2Zfi3QHMtLlnhwg1HFn+ONrxZqzLdoqnHHwvfYVk:UdFAOlnhwaHJevwKYF6aHOZWT
MD5:	AFB37C6AE618EAF2ADBD2E3D06489450
SHA1:	2A114A8576EFA46FA77880AA2EC2D4F6A37C842D
SHA-256:	E259E1C6C2EAA4AD431A8F9D66F361D6A8B536CF99D6050735F1A6BC498EC1C8
SHA-512:	1753474E1C2F9B22CCE4CA1ABF339D3775CE1E92F62712DEE36EAC99E070D5F9CA92C140992874B9D47CBA469BAB58FF0F38CD88B793601A83077F747B691CD6
Malicious:	false
Preview:	...@..@...@.....C.].....@...............(M...L..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".sssfol20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.131121077377598
Encrypted:	false
SSDEEP:	3:FiWWltlDJyPIiHSRqOFhJXI2EyBl+BVP/Sh/JzvaEIyQIRGHp1atl:o1D0PIiyRqsx+BVsJDaEnRGH7aX
MD5:	D40B7457E2175F70E3CE9AB6A95427AD
SHA1:	24D79F6BB09FE997B08D4A23B42953A9A6382FB5
SHA-256:	52DCBB856D313F64743C17383B31106A1EFB76B2E35D6F92346CC13B2A8067A2
SHA-512:	16E5EFA01AA29A6FDC0F34088E50EEBAB0A5BE67F1DE8667D85A2EA94C95DB157EA842A8614D2166B6B81194C9A06C3FCD1E363FE785A55E9757FDDB23CAC75E
Malicious:	false
Preview:	sdPC....................ni+2..zC......."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................4d523382-97ac-4b35-8485-5a8abaee04b5............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\097a5377-7550-41e9-a588-bacf9ebaf5cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1b47d099-a4a1-4bb7-b2c2-f95ec7d98785.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.978464712864058
Encrypted:	false
SSDEEP:	96:st0qfuis10Pb94QbN8zWs85eh6Cb7/x+6MhmuecmAe+CQl2Mue/EJ:st0csGbNkWs88bV+FiAnPxMJ
MD5:	8A851FED69399CB8CC3901D2B7158079
SHA1:	6714A7370A7888C2296B8D6DA70A10F6D3C7B49B
SHA-256:	9F8150291B3D4399801EB1646A7D86FE3AACA79B1C2B25B732DFE6DA77D7F666
SHA-512:	2752442520B3A02243D9807758292F7D13BC72A867EA3435D7015128104B4CA3EDA31044932908CF8CC0A092FED21BFC7D8308E5FB925F1084B22EF098592D83
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369269840226173","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369269839163645"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1d4e96d6-e791-4c40-b3a7-696eb05d1a51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\741dca0d-2efa-49f9-a261-a34b774a6eb6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9709214345168835
Encrypted:	false
SSDEEP:	96:st0qfuis10Pb94QbN8zWs85eh6Cb7/x+6MhmuecmAe+lM2Mue/EJ:st0csGbNkWs88bV+FiA0PxMJ
MD5:	A152087CD6AB16C1C71FF8A176ADACE9
SHA1:	979E8487245F1EBB24E8205A6C54FBAA01BA0701
SHA-256:	40C4A24BB2AD39E61A4686A46D9FBAC6CE20510AB54B12CD4099B0AE073DAD06
SHA-512:	55F49AE3DBC60D067409FDCA1142E8B92438EAF4E70737733C059824C916E08CADB0E4C4B51DAB2C5C67340955561C34E785C7DE2D14DB948D5CC4EE54A48202
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369269840226173","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369269839163645"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\8b5bb577-035d-404b-834c-e1cf28391ab6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6525
Entropy (8bit):	4.980263208819626
Encrypted:	false
SSDEEP:	96:st0qfuis10Pb94QbN8zWs85eh6Cb7/x+6MhmuecmAe+PQl2Mue/EJ:st0csGbNkWs88bV+FiAUPxMJ
MD5:	FF292AB8A3BF55F0F244544F38F8D35C
SHA1:	3683DB227EB857F7F7D438B95B4854BD111A30E9
SHA-256:	95BCA10E146F9A060151CC84C0C1BFA823FB113515F34ED44005C556AB2F6A4A
SHA-512:	8FCC8888B4A5E15A588125E5AEB4314B7BB62CB4825177638BE663617992F9FA4E8E89BCC90D241476B8CFE912CFA07442E57739440E251FB300A70E3C859FE1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369269840226173","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369269839163645"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\8e3c2f26-e96b-4bdc-b0a2-28c1bcf6cccc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566064867875816
Encrypted:	false
SSDEEP:	768:LOuw9GWPkCf0j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtkwpSrwJ42npGtuX:LOuw9GWPkCf0ju1jao/pX29tQ
MD5:	F7E62431F176160319F05D8A2A31A0C2
SHA1:	82A7FFFCC93BDFC26E59E7FA78F535F7A40823C9
SHA-256:	69E5265ABB6DCF19951603A3C7C10423886326045935193D8E01BEE9216CFE57
SHA-512:	E34AFCECE085D7F89D67A4B112EB9A0FE07058B5AB4E8F306A525BE0E5CA92EF72148534C03CCE29B6F64720487B05151C28DD48455C48AE91CD9BC08BE4FC7A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369269838687212","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369269838687212","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.320798655845318
Encrypted:	false
SSDEEP:	192:WAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:JOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	DC3AAE02BEF1B083E2C633782AA78FED
SHA1:	A2E83B9060DDFCE0A2E33241791AAF13FF4E22AA
SHA-256:	3E73CFA91EED1BCC5D0D85A72958ED1C94B19940BCBC18A622D68751B884ECBB
SHA-512:	9F6E161FA3D187722CA4F0C7E40E800C1FC67A1ADD7937346EDEFE4196ABDA435CF8210AEA7CF9A2C15BBA10B28D768D7018106D6E1C5FBC1FA03512FBB5C2CD
Malicious:	false
Preview:	...m.................DB_VERSION.1..e..................QUERY_TIMESTAMP:arbitration_priority_list4...13369269844443331.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.134001047959009
Encrypted:	false
SSDEEP:	6:N7Ezf81oM1wkn23oH+TcwtOEh1ZB2KLlL7Ezf8mRFlyq2Pwkn23oH+TcwtOEh1th:N7OrfYebOEh1ZFL17uROvYfYebOEh16g
MD5:	D2AB3F5B09963C6E6005811896F89E8D
SHA1:	3C5C6B9B4AA281181934E0FE06E5DC6651779D29
SHA-256:	072686F6ABA7DAD26BD8904CE81206C098BED059003B1A7304B4CA28802620AF
SHA-512:	2E08573FB88C8338196705656E60260E67EC7005EA740638DE7F975D752A240C8E5A5FFBB6B7571EBDB1021B2FFB43610EE9AC0D2115E8BB4F4F14458B7DACA9
Malicious:	false
Preview:	2024/08/27-18:04:03.682 2314 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/27-18:04:03.724 2314 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.04375046918115318
Encrypted:	false
SSDEEP:	6:/Fii2VlOkM/l+mlD+4ofMtUjEf+kllGqTVC/lcl:doLE+mp+pEzfz/GUVWcl
MD5:	800E760E31624C45F8C24B4EADA2950E
SHA1:	E396ABCB6A1539107B325032B4496990899D5C43
SHA-256:	DFA3165421B54673CFCDA56B56F07C1B698945E4BF969D595D9122CA62539354
SHA-512:	E14AD80FEEAA20748BB6DE8F045BEF26D0CB55E01C8AFCA1626CF74634261CDA06E90C72F7AC20706F7117BF4779CF42888743048809223B2380AF8FD43D1D60
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09571063748626857
Encrypted:	false
SSDEEP:	24:QLrIV4XQ3eaPVHF/jV4XeaPVHaUAPnQzLIoMy4QzRHVIRBNUeG4uFlnaYT38EWp5:FV4A3esFrV4XesrAyn6NUeGLbT3lWp4
MD5:	280B12B646A8D299F013531274915DCF
SHA1:	D397BE7F4B8F12379DB4E04A03102DB6FF4AF1DA
SHA-256:	E7B28615E8407C58912887577A649101DFD96FB250E716C1783E5584E5A0198C
SHA-512:	23E7E98CFAC33CCC97C7DB707E5B153E3AF42F5CAEF7D643F8F859CAD00F8FDCE97759C20E3D2DEC4F7093F52FB95F9C0D481BAF7C93AECDD3293D7A649DD481
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.28343961515078503
Encrypted:	false
SSDEEP:	192:kdl0SPMJZbtMsMjfl0SPMJZbtMsUg/JZbtM4/g/JZbtM4r79c7ujnJZbtMC3UaG:MeJtnMjeJtnpJtb2Jtbv7JJtRo
MD5:	681F4510E8FB27F0C96C172FE164957F
SHA1:	540F2DDA63BF86AB1A4481CE8ED4E48A4E8F90B1
SHA-256:	EA6F1F99D48750A5CB53AD7F614506E3843BDEBB09FD675F3E005FA7B666F251
SHA-512:	3C599A4FF8F3777C1971F91F98B83B985D9740EC4F75B59B46C63209A3F853F472A9B0AA2B00671398B7B2AF745FD4D78692A43F6133737AC2ABC2836282BF5D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsul9rp:Ls
MD5:	2FA444F6017C8E85E86F34027279882A
SHA1:	0F554D284B0B65B48B904478B3A8808CEC45C1F7
SHA-256:	BCED82136EB8991FE5EE77F21FDF52A4B651535B992DB89451FFC07782029DCC
SHA-512:	236D75D04E90D35C74287B1E818DFE09D7CE461F09998738960521C70D73C68AF508BAF5BCB466FCA2E84F8ED1749E3A4B5C75C4A1332EE04C222D6E1A2533EC
Malicious:	false
Preview:	...........................................G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:jIwwKcFE0E9ofn:0wcFw9of
MD5:	4E2D5F7F5368CF6A5937EDCE0D44D54F
SHA1:	307DC30E525506923B67F02B6059CB8DF0F721EB
SHA-256:	17D1A3EF72A8B6E78927C012E060CA5713C09FC7CA6694456E7C36277C124687
SHA-512:	BDEB30BCD69838DCFB11186A80BED581C466EE5C1F151DC57E251D0D4BF3C1B70BA07FF1E22835ACD2F19852568B1670AD6E48A7EDCBE008D4360D4AEC2EC266
Malicious:	false
Preview:	(....-..oy retne............................G./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:jIwwKcFE0E9ofn:0wcFw9of
MD5:	4E2D5F7F5368CF6A5937EDCE0D44D54F
SHA1:	307DC30E525506923B67F02B6059CB8DF0F721EB
SHA-256:	17D1A3EF72A8B6E78927C012E060CA5713C09FC7CA6694456E7C36277C124687
SHA-512:	BDEB30BCD69838DCFB11186A80BED581C466EE5C1F151DC57E251D0D4BF3C1B70BA07FF1E22835ACD2F19852568B1670AD6E48A7EDCBE008D4360D4AEC2EC266
Malicious:	false
Preview:	(....-..oy retne............................G./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:On0XTEeuW8:Ougj9
MD5:	B24A5CE595975601A6012D08AED8F9BB
SHA1:	5FE335316E8A36529D3B09CBFE83E12FDC804144
SHA-256:	7786D3F5D4BCD1973733DD265E57869E834B37F680171CE8B66D855064F7A260
SHA-512:	25A0B25B4429846A1DB81A9ADC59A52A74A23B5BDDCEE686EFA2EC01A4FFBD99D312E97CFEDAE8834362FCE85B067E97084684EC17A4C4C5921A819AC8B420E6
Malicious:	false
Preview:	(....G.oy retne...........................G./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:On0XTEeuW8:Ougj9
MD5:	B24A5CE595975601A6012D08AED8F9BB
SHA1:	5FE335316E8A36529D3B09CBFE83E12FDC804144
SHA-256:	7786D3F5D4BCD1973733DD265E57869E834B37F680171CE8B66D855064F7A260
SHA-512:	25A0B25B4429846A1DB81A9ADC59A52A74A23B5BDDCEE686EFA2EC01A4FFBD99D312E97CFEDAE8834362FCE85B067E97084684EC17A4C4C5921A819AC8B420E6
Malicious:	false
Preview:	(....G.oy retne...........................G./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlbi:Ls3
MD5:	45330CBD9CD88A398156682025E59DD8
SHA1:	15FB3C1E2EF5DFF8646DD4313FF9733C32A01EF9
SHA-256:	8DDA008B8CB5C45265AAFC5C431527CBF236D729567E54BEB4429395508FE15B
SHA-512:	A46CF4F0233731A684FF508E918F474DC7C769E7547E157449D4671EEA03927DE80BB0FA802E48B9ED917F7CB710C7CD4D912A97CDAE355E0B7982D65E346DA5
Malicious:	false
Preview:	...........................................G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354093826018055
Encrypted:	false
SSDEEP:	6144:GA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:GFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	4058A3656403BCF327C87292AD945069
SHA1:	289AE04EDB09D8A4818040C2DE5C6B8888C38556
SHA-256:	27F0184A0B2BAC0C7E8A44237BED6D4287138C4D15969EFF64B65242E6D22DC4
SHA-512:	64CB501FDDD0EEC5E24352187A902A01AD654D366D1FF53F556C53172C78386D2827DCB8CBABB0F01A7694A7A60F2B00E38465921D1095282B4F670F1CFA944C
Malicious:	false
Preview:	...m.................DB_VERSION.1n@0.q...............&QUERY_TIMESTAMP:domains_config_gz2...13369269844509737..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.203638954181747
Encrypted:	false
SSDEEP:	6:N7Ezf8m9SF+q1wkn23oH+Tcwtj2WwnvB2KLlL7Ezf8meq2Pwkn23oH+Tcwtj2Wwp:N7u9D1fYebjxwnvFL17uevYfYebjxwnp
MD5:	2BB1BC4872FF58BB444533F8D7F1D4A2
SHA1:	3DA32E5C88A3EEE24FFF9BF5642349C2E6C56AF5
SHA-256:	CB38E71CB9612FF1C5797B104E13F98A9B5EF0AAF404E8BB55371ACEA8BC42A9
SHA-512:	EFEE5393DF03B42C628424276F95346650ACB63E5ACCB98BF5D83CBD436B2BED05D744642B4C3BF7D8B69ECBE14C3CA36D24785B4A6B0C1E4FB43D7ACB03A80A
Malicious:	false
Preview:	2024/08/27-18:04:03.735 2340 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/27-18:04:03.774 2340 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324622452893731
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R9:C1gAg1zfvl
MD5:	57F3819EAB9E3975B46A53B9DBFA10D5
SHA1:	06E90983A0F9A11D9BF009A19E859F82A3D790EE
SHA-256:	AE10A3EAAF2329047254B0A390F88A009BD3A5AC0C27266EF2A129AE7FB3CD89
SHA-512:	00A74656F47048B22939C132BEA776B02E0A5C9924B861CD19B9C3B421DCF818C06D1908177BD948785A6E1B3E986549E99F28E454D3E07E82005826750F66C9
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.212201673977071
Encrypted:	false
SSDEEP:	6:N7EnkRoM1wkn23oH+TcwttaVdg2KLlL7EnraMq2Pwkn23oH+TcwttaPrqIFUv:N7KYorfYebDL17KraMvYfYeb83FUv
MD5:	DB9A009CC66EA891C2D9AFFEAC19A20F
SHA1:	BD2001CD1300CB49F12B65551259E1AB2FF52567
SHA-256:	344E5BF57F3CFE6297FC472F6D6BE21FFEE052D86E3067660BCC7A33BD173869
SHA-512:	11B2F30BDA19A8E8089FC059D313BD0C1765B345931CD011F5AFCD0495CA92C7FA3379689E116CC3944878204310F662587C0D207E28D6FC2DF59ADF48740DA6
Malicious:	false
Preview:	2024/08/27-18:03:58.758 1f44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/27-18:03:58.770 1f44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.19686577186734
Encrypted:	false
SSDEEP:	6:N7EnRaoM1wkn23oH+Tcwtt6FB2KLlL7En3M+q2Pwkn23oH+Tcwtt65IFUv:N7KLrfYeb8FFL17KlvYfYeb8WFUv
MD5:	6A1AAA269DAB92ABEE00B413A1DBDB60
SHA1:	64F88220230DEF998B0998022CDA66631693D838
SHA-256:	F7A48BECE5BCA7E6CB81930E4638CF71E668F488884C9D76F64682D03A80A6ED
SHA-512:	44B423BB8347C23673CAC70EB57C961370BCBABA542C5BC033D6D5263FEFA4815233080E021D64494264DD443D722BA17A8A43DE0ABF1A6772745E3903D7A030
Malicious:	false
Preview:	2024/08/27-18:03:58.772 1f44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/27-18:03:58.884 1f44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.155776000496263
Encrypted:	false
SSDEEP:	6:N7Ezf5hq1wkn23oH+TcwttYg2KLlL7Ezf6FL+q2Pwkn23oH+TcwttNIFUv:N7GLfYebJL17TyvYfYeb0FUv
MD5:	3473F6EF23443B82D50C683A4CE813C4
SHA1:	F1919EB1DB716F9A9128F9D54A1FF92B830DB3D5
SHA-256:	030DD6558785E14733E57410314CF05426F2CCE504955A8857B1122A7FCC5686
SHA-512:	4A51EDF75DBA6A2A84CA7CDDC20E0A659DC5196CF9D22B7C595FB595E9090CCE07CC1D6088BC5DEC5D5B3D9C64679F42A18CF5E6DA00D8349C4D858979C48D89
Malicious:	false
Preview:	2024/08/27-18:04:00.548 1f18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/27-18:04:00.562 1f18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlBW5K:Ls3a
MD5:	4D49B65C38DAB9D2C0BA7796F825EE58
SHA1:	642CC713D020662BEA4686D3CB64AC6CFB54F940
SHA-256:	7A7D46B73AE3A7A75A4AE9D790484B6C3605717BBE0253EDB2301702363AC37E
SHA-512:	D538780FEB97414BBAAAD9862D7BB06EEEEB87501AFCB4F3686741E200E8CD414043435B87443751FCA1C520C816973447509DB1CEBB61B083F0E0A064113066
Malicious:	false
Preview:	........................................63..G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21861961848037045
Encrypted:	false
SSDEEP:	3:wljtFlljq7A/mhWJFuQ3yy7IOWUA4dweytllrE9SFcTp4AGbNCV9RUIb:wK75fOTd0Xi99pEY9
MD5:	855825A0047B08FEE93D4A64752FC8E0
SHA1:	262A382AF2002D8EA798A8E3FDE203E14D78DF8C
SHA-256:	C6903C6BAE18CBCFE03253B1082F0D5E435399455D1862CDA0ABFC97E322CB6E
SHA-512:	72E3EE5A9A4C9FFF6484FF36979000DABA7CECFEECE44CDD02817B86EC182B76E4A011F42698E1724659FEDB1A54320447E7548A3EF0EB7FBBAC54CAC86E4090
Malicious:	false
Preview:	...................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.22567761554443
Encrypted:	false
SSDEEP:	6:N7Ezf+am81wkn23oH+TcwtRage8Y55HEZzXELIx2KLlL7Ezf+GOq2Pwkn23oH+TF:N7dTbfYebRrcHEZrEkVL17dzvYfYebRz
MD5:	3A15E04ECF729D8D02BE1915415397C5
SHA1:	34BBB77A59553B4C3F6BF10F5169C19422B000F4
SHA-256:	E6FFB45C7826B0D3DA912A78D1C40CBDCFFA6C83C3935736C40D23BC0BF73B53
SHA-512:	E496803F254E3EBE3B5E3158EB732414EFBF122C0D0CF7D47705D091164078602AFB4A70332C4347D494D2CDCCB656056B3BB197A7A02E30CB6A3336DE50D866
Malicious:	false
Preview:	2024/08/27-18:04:01.519 1f10 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/27-18:04:01.531 1f10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.234552768274873
Encrypted:	false
SSDEEP:	6:N7EncLp81wkn23oH+TcwtRa2jM8B2KLlL7Ezff3+q2Pwkn23oH+TcwtRa2jMGIF2:N7KwfYebRjFL17HvYfYebREFUv
MD5:	D9F5C3306F95B2720EEE5517E69B5EAE
SHA1:	B6EDB593ABD0416549F53A411CD8ADDA9D81E89A
SHA-256:	5B8919D641B3B176AD90B495C664398E3239D68E187B291D1D1B7761A4ECA7B3
SHA-512:	E0B3F98DA7506B475E884AB2227B8E198DEA0284E7F0106B896860C227776FB00088D905EB8A91B0FB84B7FFEBE15CD2D79B7FCEA56EEA4E4BAE9E4932BECE6D
Malicious:	false
Preview:	2024/08/27-18:03:59.714 1c78 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/27-18:04:00.599 1c78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\3ff406ab-16bf-407d-98f4-8944a6786cd3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\44ee14ff-eb59-4bfc-863a-04af033d4134.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\52f6a217-3225-4b98-839c-896069234f61.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\83a7e557-a34e-4dae-8c50-72e77c491048.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\8d9c6402-1f96-45a0-95f4-b01b76e2eec9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3bdc3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7606697196610909
Encrypted:	false
SSDEEP:	48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkbD:eIEumQv8m1ccnvS6YD
MD5:	E41BFD21BF1E5A88D2BAF0E43B34E14E
SHA1:	FA2220DADD5DECEF34BDC5EFF4F7D4CFCF07CE6E
SHA-256:	ACDBEDFD02EAF2C13570DA3E42A57ECD1B3B55D25B4FAAFD77818E46A62356F6
SHA-512:	B1CC8B55534D663236B374D8B73476869ECFEF4DE020B2EB3D41593C8916CDBBEF42CBA9E64DDAF408634B8A10A8EA17F7CEE6F8AB7ED4B124F1D01F015B86C6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF29c26.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9709214345168835
Encrypted:	false
SSDEEP:	96:st0qfuis10Pb94QbN8zWs85eh6Cb7/x+6MhmuecmAe+lM2Mue/EJ:st0csGbNkWs88bV+FiA0PxMJ
MD5:	A152087CD6AB16C1C71FF8A176ADACE9
SHA1:	979E8487245F1EBB24E8205A6C54FBAA01BA0701
SHA-256:	40C4A24BB2AD39E61A4686A46D9FBAC6CE20510AB54B12CD4099B0AE073DAD06
SHA-512:	55F49AE3DBC60D067409FDCA1142E8B92438EAF4E70737733C059824C916E08CADB0E4C4B51DAB2C5C67340955561C34E785C7DE2D14DB948D5CC4EE54A48202
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369269840226173","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369269839163645"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF32c22.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9709214345168835
Encrypted:	false
SSDEEP:	96:st0qfuis10Pb94QbN8zWs85eh6Cb7/x+6MhmuecmAe+lM2Mue/EJ:st0csGbNkWs88bV+FiA0PxMJ
MD5:	A152087CD6AB16C1C71FF8A176ADACE9
SHA1:	979E8487245F1EBB24E8205A6C54FBAA01BA0701
SHA-256:	40C4A24BB2AD39E61A4686A46D9FBAC6CE20510AB54B12CD4099B0AE073DAD06
SHA-512:	55F49AE3DBC60D067409FDCA1142E8B92438EAF4E70737733C059824C916E08CADB0E4C4B51DAB2C5C67340955561C34E785C7DE2D14DB948D5CC4EE54A48202
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369269840226173","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369269839163645"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF3a181.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.9709214345168835
Encrypted:	false
SSDEEP:	96:st0qfuis10Pb94QbN8zWs85eh6Cb7/x+6MhmuecmAe+lM2Mue/EJ:st0csGbNkWs88bV+FiA0PxMJ
MD5:	A152087CD6AB16C1C71FF8A176ADACE9
SHA1:	979E8487245F1EBB24E8205A6C54FBAA01BA0701
SHA-256:	40C4A24BB2AD39E61A4686A46D9FBAC6CE20510AB54B12CD4099B0AE073DAD06
SHA-512:	55F49AE3DBC60D067409FDCA1142E8B92438EAF4E70737733C059824C916E08CADB0E4C4B51DAB2C5C67340955561C34E785C7DE2D14DB948D5CC4EE54A48202
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369269840226173","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369269839163645"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566064867875816
Encrypted:	false
SSDEEP:	768:LOuw9GWPkCf0j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtkwpSrwJ42npGtuX:LOuw9GWPkCf0ju1jao/pX29tQ
MD5:	F7E62431F176160319F05D8A2A31A0C2
SHA1:	82A7FFFCC93BDFC26E59E7FA78F535F7A40823C9
SHA-256:	69E5265ABB6DCF19951603A3C7C10423886326045935193D8E01BEE9216CFE57
SHA-512:	E34AFCECE085D7F89D67A4B112EB9A0FE07058B5AB4E8F306A525BE0E5CA92EF72148534C03CCE29B6F64720487B05151C28DD48455C48AE91CD9BC08BE4FC7A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369269838687212","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369269838687212","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF2fc29.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566064867875816
Encrypted:	false
SSDEEP:	768:LOuw9GWPkCf0j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtkwpSrwJ42npGtuX:LOuw9GWPkCf0ju1jao/pX29tQ
MD5:	F7E62431F176160319F05D8A2A31A0C2
SHA1:	82A7FFFCC93BDFC26E59E7FA78F535F7A40823C9
SHA-256:	69E5265ABB6DCF19951603A3C7C10423886326045935193D8E01BEE9216CFE57
SHA-512:	E34AFCECE085D7F89D67A4B112EB9A0FE07058B5AB4E8F306A525BE0E5CA92EF72148534C03CCE29B6F64720487B05151C28DD48455C48AE91CD9BC08BE4FC7A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369269838687212","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369269838687212","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.172042238907791
Encrypted:	false
SSDEEP:	6:N7EzfUa81wkn23oH+TcwtSQM72KLlL7EzfUd6t+q2Pwkn23oH+TcwtSQMxIFUv:N7MfYeb0L17XvYfYebrFUv
MD5:	934FFAA40D8204ECC02AAB8E3CAD0BF9
SHA1:	D7A8C67BB49CF672293626545066DC93DF5B24CE
SHA-256:	0D7F442BE64BF969D3CBAEF2775396F22D80C8DCE46FE5F1CEC13F73D71DC75A
SHA-512:	0ACCCA8AFA31731A31AA004259D87A849C956D568E53491D7C3FB17A82DFE0D92D30FD17497EF8E92EB7C10FCB4214BE9546EF19E32D079859BC8BC911892EA5
Malicious:	false
Preview:	2024/08/27-18:04:16.441 1c78 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/27-18:04:16.536 1c78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.1437484005714955
Encrypted:	false
SSDEEP:	6:N7En1RoAEq1wkn23oH+TcwtgUh2gr52KLlL7EnQTq2Pwkn23oH+TcwtgUh2ghZIg:N7K1Roh1fYeb3hHJL17K8vYfYeb3hHhv
MD5:	7837F53F16281D8ADE268A7F9F289B47
SHA1:	8CBA2853424111714A58B5B16A71EE8916082682
SHA-256:	0F66D23ADAE0910913391D544BFDB4597A59678D64545C418D2EC6B4456EBC9B
SHA-512:	00ED4F532413D38AD45D00071C9058EA3109BC71F05C4954FD6AA4D38FEEB6AC25FA11DBB32C4205DFCAA1A04768FDF5AE13D4304FF935DE18FF30D1E9DAA6A9
Malicious:	false
Preview:	2024/08/27-18:03:58.735 1f40 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/27-18:03:58.890 1f40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulSKl:Ls/
MD5:	C0D3B71237A743C9BEEA0DBAFE1072CB
SHA1:	DF442995B8706558064AFC7C4431626A1D65EDF2
SHA-256:	21AAB2B54B64D1FC8383DF56ADD165C047BF171942E9090C5223F54D99D85665
SHA-512:	FE0E026C64FFEE0038F2BE5044E6589B228D481640AA5FDC6B9B58466BB4E9DDBF4D7C8363F532EE2FDE317AEB8F5396CDBC8E58D04133E66B95CA297B8EB688
Malicious:	false
Preview:	............................................G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.868671614087538
Encrypted:	false
SSDEEP:	3:IhFQyEcea9:IhFw+
MD5:	3B73CCCC0F31BF99EDA582F07755A426
SHA1:	0B02EFBFFE4A4B8FFC6DAB5DD38EB56250256E01
SHA-256:	4D90A9203C10AC380EF6BD7EE404F0E078B22AF1CAF0C1436D2A5F8FEC73D115
SHA-512:	8F267D006BBBC2BA1D0F7A95EC94D437CF42870BD67A85B478AF0C445DA7DB3678F23AEB08EC8C7909BFC622F70D6FC98628D73D57A55F2BFD97AE7C26E4733D
Malicious:	false
Preview:	(.......oy retne.........................;..G./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.868671614087538
Encrypted:	false
SSDEEP:	3:IhFQyEcea9:IhFw+
MD5:	3B73CCCC0F31BF99EDA582F07755A426
SHA1:	0B02EFBFFE4A4B8FFC6DAB5DD38EB56250256E01
SHA-256:	4D90A9203C10AC380EF6BD7EE404F0E078B22AF1CAF0C1436D2A5F8FEC73D115
SHA-512:	8F267D006BBBC2BA1D0F7A95EC94D437CF42870BD67A85B478AF0C445DA7DB3678F23AEB08EC8C7909BFC622F70D6FC98628D73D57A55F2BFD97AE7C26E4733D
Malicious:	false
Preview:	(.......oy retne.........................;..G./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:j6GQyR0E6CdUl:Gby9k
MD5:	A3FE358384C26F64905D4EACC7AF5D05
SHA1:	A1F4D4316E96D9CF53DA462B32984CDB6A3417B6
SHA-256:	048FEEA669FBD2369B1139083269FE2C528703672038BD6CD1B0127B210C9710
SHA-512:	F69B049B311A685008956439FF5363A04C73721D55200501426ACC7CE946D7BCEAA3DCAFCE7C7B18B7D9B01081F9AB99EA3CFA485C33203E3668BB3052F72AB1
Malicious:	false
Preview:	(...~.c.oy retne........................&'..G./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:j6GQyR0E6CdUl:Gby9k
MD5:	A3FE358384C26F64905D4EACC7AF5D05
SHA1:	A1F4D4316E96D9CF53DA462B32984CDB6A3417B6
SHA-256:	048FEEA669FBD2369B1139083269FE2C528703672038BD6CD1B0127B210C9710
SHA-512:	F69B049B311A685008956439FF5363A04C73721D55200501426ACC7CE946D7BCEAA3DCAFCE7C7B18B7D9B01081F9AB99EA3CFA485C33203E3668BB3052F72AB1
Malicious:	false
Preview:	(...~.c.oy retne........................&'..G./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlol:Ls3
MD5:	1D2AC4E8C214F5BD7AACDBDA517DAF13
SHA1:	31603BF604C7D9931778249624FFEA9E43B826B9
SHA-256:	2731226D612CCBAA3D12E56E2888AE6ACE18D905E35ABE5DC7666B30B849EA32
SHA-512:	80995C582D27260DFC5E757A83E015E57945101B64BA3D789B21ECAB730F0190AF59169F300E11ACFC3E68ED9F393AD902F380118A170A1A74FB59E8A0128997
Malicious:	false
Preview:	.........................................9.G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlhg:Ls3
MD5:	AA16294DAC02CE4B67DDEA7E16C67143
SHA1:	C8908AC30EF334954E6235BBBB906F4ADAE48AD7
SHA-256:	B844A3652844DDD35A4C8E5CA04A121A7D66096444641C78398AC5C44AE99BE1
SHA-512:	7BE297B71A55F9A5A51C617C13E55A36B758341FE7E8A680B05D00101EDBDD744A043D4106CF953A1BB163E16C9F1F447076C8A8A54BE9BAE7E2667483824B5F
Malicious:	false
Preview:	.........................................5.G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.214294021658068
Encrypted:	false
SSDEEP:	6:N7EzfhD1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLlL7EzfMBM+q2Pwkn23oH+Tcwt0w:N7lfYebqqBvFL17y+vYfYebqqBQFUv
MD5:	1FA4879426328D8D292DC1681EE19EE0
SHA1:	AEA6743B594ACF0BC55646DA1A8C41EC57CD4C0A
SHA-256:	E55742F4D276F8ED55F5BDC20DD94C9833E1196D40F87E98D435CA1988C1B7BA
SHA-512:	FD0E8F8EBE829AC4D51010835C7F8C96120CD7893FBA06069B7211E88116C2254F84919FC82BFAF4EA1A4B7CF616682BB0DBABDDB4BFCB111C21DACD304E127C
Malicious:	false
Preview:	2024/08/27-18:04:00.597 101c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/27-18:04:00.621 101c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\893d61f3-c307-4537-9b84-ce65ae0e85a7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\99ad58af-eba8-4435-8f80-7a7e881cadb5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3bedc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e7de62ca-5478-4fac-887e-4541c645c7fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ffecbdf7-1692-4de1-b6ac-bea01919720e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.213405341544191
Encrypted:	false
SSDEEP:	6:N7EzfU31wkn23oH+Tcwt0jqEKj0QM72KLlL7EzfUh+pM+q2Pwkn23oH+Tcwt0jqw:N78fYebqqB6L17qi+vYfYebqqBZFUv
MD5:	67C92AAFF022C471A5A9D766067FABB3
SHA1:	D0A29FBDA178BEF003FDB439927C0E1B57FCAAE8
SHA-256:	5C479F35EE6D6ED2BBA44E3EBED99D10BFA002CBFA1368DDFE9EDE0181BC5F6F
SHA-512:	1468F166B21ABA61E01100E3266F7BCE5BCD6BEC01B531CE0A16E0A2199B04CB4DE26E8072935EA978A2A6EC703B178DC68B8A0A58FE8C8B75649C604C0FECE4
Malicious:	false
Preview:	2024/08/27-18:04:16.469 101c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/27-18:04:16.526 101c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.232165031350063
Encrypted:	false
SSDEEP:	6:N7En0L81wkn23oH+Tcwtkx2KLlL7Ena5q2Pwkn23oH+TcwtCIFUv:N7KGbfYebkVL17KivYfYebLFUv
MD5:	45888E5B783EDC535D1F9FFD1DC4B1B4
SHA1:	F3A62C3AE2AD5D19AE3511FE8B82BEFF0F28C58A
SHA-256:	3494291CC81D5B5A990E23AC6BF16B55BAD1E19EF8D4ADF42DEB75E61544D6C0
SHA-512:	72F3EACE3AB66271C22107B8BDE018A4751FA05287AD33566F93E04C65CF74EDAB563F95BFD05392820CC2CAC3DCF0AE0609692D5E0964BD36F354F88F605738
Malicious:	false
Preview:	2024/08/27-18:03:58.701 1f10 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/27-18:03:58.743 1f10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVU7tl:IiVU
MD5:	42BB0265C367FE26C05AF0E6BA6DAED9
SHA1:	6ED918DC464C47911C5AB4DCED81F284C5FADC37
SHA-256:	E3C431BD68AA765236052F0F79E72E7E430567DA396AFC84C5156D207A2991A8
SHA-512:	3D35F2BE7E58C84B9B89608D5C3FD3DFFBFE78F2ECC8AE19724420AEB9127F82827EC64604B8A5FAAB90EE1030743C10B392584D1AD41CF3EA088E2F1BF20794
Malicious:	false
Preview:	VLnk.....?.......v.3_.uP................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.077063631901737
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOeSAE+WslKOMq+vVumY0jn66:e/2qOB1nxCkOeSAELyKOMq+vVumrp
MD5:	A538143B7CE3AC11A5E24E4CFE608F51
SHA1:	98CA4C0231CABF4C4ACB669E5FD93C5E07F4F948
SHA-256:	1D181399963013E5368EB8A3EE64C770FF12436C5B1154C2A11E379E5EB6215A
SHA-512:	9EF77A397863F073C334C5D911807CEF0712A7C35D9CB4E34D8963345E0D1DF3711B51BCA2022153362AA10C4005E7212C30CFF3934E8317156F80999F3E5BB6
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\eb4826e4-bc11-43f8-91ad-1670ba271b5d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.566121126313487
Encrypted:	false
SSDEEP:	768:LOuw9GWPkCfnj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtkwpSrwJ4AnpGtuj:LOuw9GWPkCfnju1jao/pX2Htg
MD5:	4802395FCE44DC74A25D7CB985CD70E6
SHA1:	6B701A47763F64A4FE2B24EF6839AB8BDE7172E7
SHA-256:	921F89696211CAF318F49AF8A5CF7D5EA8AE3A36541AA728E4F6664CFBC20C87
SHA-512:	5B8D4E0BD2A47647A570193832228072799975D78EC45DE233164092D5351B5E7F67B8D9E99C617F78B6E898F659D888FE05E1945DBD0FD3143FD590BC20EB81
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369269838687212","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369269838687212","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/ViXll/lFll:7+/l/V
MD5:	0F8261160E1ECB0E1C649299894A9B10
SHA1:	8F43475425688AE6B204C743311D8DE1EF1F4E01
SHA-256:	DA45F026253CBE90E19962115B3D4A066E14C72F4D59B21705DA7652AF913A90
SHA-512:	7671C887BB6BE32194440517BE2A196324B0F1AF1B3954A0BF421782A3DF45B4A2929587C49CAA1E0EFBB775B308CD16A336BF064B29C8DB6204B5A8F8EA243C
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.05010601478646411
Encrypted:	false
SSDEEP:	6:GLW0avwRStLW0avwRcL9X8hslotGLNl0ml/XoQDeX:aavFbav5GEjVl/XoQ
MD5:	4DD453C05208F799C9BBC6AC126AF775
SHA1:	95A95BBE9187920E945E6DFA99F14A893E92D616
SHA-256:	62869CF9FAFA3258A82AFAA4C7C997567546B3A0042397C49F463BD840F95EF7
SHA-512:	8077E5F48E58A8754813D329E5AAEB42A6E084564B366C5215163B093BF7ED7AC222371D729CF2BEBB7C542DAB5A2067960CB27CF968C45C22E0C24D0DF80375
Malicious:	false
Preview:	..-.....................s.....f.(..m.....y'.......-.....................s.....f.(..m.....y'.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9982160824132729
Encrypted:	false
SSDEEP:	48:1mzxxlO+ZcbX+i2n9VAKAFXX+8F2VAKAFXX+FqxOqVAKAFXX+VnqnUYVAKAFXX+U:1exljENs2NsFgO5NsjNs+/P
MD5:	0424172BA5FA6A7DEFF34B90AD23B552
SHA1:	2C8ABCA399F91E67456C619B2A6590F6DBA04D0C
SHA-256:	F2A5749B79348A9F030B8F9D9C62087EED783D9AFABEF8126675CCF6ED09BBA8
SHA-512:	1B8F2809E2933068E728045AC53F71FCFEDBBC00FC8674868AB87FDF7D6C5773561B1687446B53D2AEF17067B0DF1E48845813ECE77618E57E1C1D948CDB8976
Malicious:	false
Preview:	7....-..........(..m....B.;.n..........(..m....Lu."...SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.495776346546103
Encrypted:	false
SSDEEP:	48:gvY8GSBSRNQQEPPHRHrxRIYjIYfzPqkiMYjMYDyAAlkfAlkE3:M0EQAIYjIYfzPbiMYjMYRYcYR3
MD5:	7CC11E0A69990313F927A39B6DFE684C
SHA1:	7C1830E80EB3CEA9426A983D94A2E0174DB31ACA
SHA-256:	26F3FEF89FDE256B6B2DD9B0D10509E05CBCEEBCECE83C06D2B086F994F07677
SHA-512:	7CAD5115DFBB951B6CB9D6DB20FD158AF172049A28AA740EFD662D9FBAC66D149B0E02812B2A0D91762FFE076A51ADEC91540658E8AEABE8FF1091F126693C43
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f....................................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFe

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.303763888613669
Encrypted:	false
SSDEEP:	6:N7EncL3M1wkn23oH+Tcwt0rl2KLlL7EncLMq2Pwkn23oH+Tcwt0rK+IFUv:N7KWrfYebeL17KtvYfYeb13FUv
MD5:	419C11C4609147763A1E20065CFA7EDB
SHA1:	7B92CEE8BDE22A6ECCB47EFB9C26AD9A70155DDB
SHA-256:	D9F54ECEBED145DABE0D7933DD6F83FED2EACA1CE10FDE87324AC7633FFD8A15
SHA-512:	9FB1D04EDD35945CB3BD0C4D3D71A0890E92ED1AB56A9AEA97278A9DCAD0279AE01FE54D1CF9AD013FF61B69C50F1646AD4FFC7AA760212BA4F2E0F44E072CD0
Malicious:	false
Preview:	2024/08/27-18:03:59.565 1f44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/27-18:03:59.584 1f44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.958141412815535
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Wui+it/4JbZfPStub/RG0lbANqa:G0nYUtypD3RXi6FZfc25m
MD5:	FBC524D02048C176A0A5D1B8B752932A
SHA1:	294C48557549A4C978326D9B7969E293A024F157
SHA-256:	F3FC95AE128DB918FC126F15CD9D96618482BA6ACCC622AAA19B10CE80B15EA0
SHA-512:	9B6434442E11610B8B5DDA43AA56656599925C9C8F0A364DDB69D15B37A912D223EE600012468E0DB723CAF3546FFBDF56F085A0159EA7968BBACE894AAFF856
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....!....................3_.....n.b..................4_.........................37_.......`.................38_.....].$&.................39_.....4.9..................20_......R...................20_.......1..................19_......(...................18_.....:.=..................3_......W2..................4_.....)..>.................37_..........................38_.....h.#..................39_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.266437370195519
Encrypted:	false
SSDEEP:	6:N7EncLPVM1wkn23oH+Tcwt0rzs52KLlL7EncLRqq2Pwkn23oH+Tcwt0rzAdIFUv:N7K0rfYeb99L17KOqvYfYebyFUv
MD5:	51B011B03265003BA056B5B9B1613F6E
SHA1:	62002CF72DE2F2751A0A8E0626109E5CCFC13C91
SHA-256:	06C72A04BBC0E78E3BB5505E37B887EDE7C59331627A61FABF2282AB61FFFB4F
SHA-512:	77F7168F83C49C30E12297FA9ACF02F44D33E9DE9BA65D729B4462FCDF71D8533DE1F62A0509172EEDB3C868922A628E43F74C27A2CB79FFFAB83A059C77B1B5
Malicious:	false
Preview:	2024/08/27-18:03:59.189 1f44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/27-18:03:59.562 1f44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlxaKl:Ls37
MD5:	6EAF6BD329C97F55C59D0A2E2D45397B
SHA1:	BE1D61C54FF10C1A54914B15048A1E3D0AE74241
SHA-256:	3D9888D8CF76256D6A24176733B30BD278F2A36F270273A7FF13DBBACEA04FCC
SHA-512:	A7663BE8B825B096EC8F9AAEC68B73FEAF51E52162C46BE4C1E1CD56DC6DFD1E88EEAC23D9B3D061F9BF4E4AC96E1482B432DC8F97CB2E1316CF6A885C920C9D
Malicious:	false
Preview:	........................................&p..G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlWkW0:Ls3WkW
MD5:	F8C5887557EEBD237D199514B9542CF4
SHA1:	C14D756582A0DB948A0D89FC41AB20EE0F31C1A1
SHA-256:	0DAFE5084506BE12842A95D4A321CF8A6BC3520B82B73706EDEC86F6C93BA27D
SHA-512:	F4B53705585AF778405E7BE2F1EC7B41327D4D40374E6FC21D047972C736B67D6942EF00A532C9EFB710D696A4B361E171E781D5C199207E4EC26C830C3F2A69
Malicious:	false
Preview:	.........................................0..G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.541431583223233
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtIdWmpIkayHt7ShdyikqeSJdXBuBuwBQja1olNhRpTXqu1QQRZ:YuBqDPafgWmpaydApdeYgBzBQjsopXTx
MD5:	2EEA0ACEF9AF248F3B75B2900623F37D
SHA1:	99809102DD85B27424CBE89155893E51E6D9A423
SHA-256:	5740EBD2204FE93AD235F777EE4C7E49826FF857220AEC39F20702576ADAFCC9
SHA-512:	E658F5871A09F25A70C2B536CBDF9E2D35548EAC2CFC912CAD362026930E3CEE19545564F66C1227DEA92033235D7E123AAAA07BC86E64D29BC734B57A1CAB8E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"profile":{"info_cache":{},"profile_counts_reported":"13369269838015595","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724796237"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28e6b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.541431583223233
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtIdWmpIkayHt7ShdyikqeSJdXBuBuwBQja1olNhRpTXqu1QQRZ:YuBqDPafgWmpaydApdeYgBzBQjsopXTx
MD5:	2EEA0ACEF9AF248F3B75B2900623F37D
SHA1:	99809102DD85B27424CBE89155893E51E6D9A423
SHA-256:	5740EBD2204FE93AD235F777EE4C7E49826FF857220AEC39F20702576ADAFCC9
SHA-512:	E658F5871A09F25A70C2B536CBDF9E2D35548EAC2CFC912CAD362026930E3CEE19545564F66C1227DEA92033235D7E123AAAA07BC86E64D29BC734B57A1CAB8E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"profile":{"info_cache":{},"profile_counts_reported":"13369269838015595","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724796237"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28e8a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.541431583223233
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtIdWmpIkayHt7ShdyikqeSJdXBuBuwBQja1olNhRpTXqu1QQRZ:YuBqDPafgWmpaydApdeYgBzBQjsopXTx
MD5:	2EEA0ACEF9AF248F3B75B2900623F37D
SHA1:	99809102DD85B27424CBE89155893E51E6D9A423
SHA-256:	5740EBD2204FE93AD235F777EE4C7E49826FF857220AEC39F20702576ADAFCC9
SHA-512:	E658F5871A09F25A70C2B536CBDF9E2D35548EAC2CFC912CAD362026930E3CEE19545564F66C1227DEA92033235D7E123AAAA07BC86E64D29BC734B57A1CAB8E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"profile":{"info_cache":{},"profile_counts_reported":"13369269838015595","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724796237"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF29040.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.541431583223233
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtIdWmpIkayHt7ShdyikqeSJdXBuBuwBQja1olNhRpTXqu1QQRZ:YuBqDPafgWmpaydApdeYgBzBQjsopXTx
MD5:	2EEA0ACEF9AF248F3B75B2900623F37D
SHA1:	99809102DD85B27424CBE89155893E51E6D9A423
SHA-256:	5740EBD2204FE93AD235F777EE4C7E49826FF857220AEC39F20702576ADAFCC9
SHA-512:	E658F5871A09F25A70C2B536CBDF9E2D35548EAC2CFC912CAD362026930E3CEE19545564F66C1227DEA92033235D7E123AAAA07BC86E64D29BC734B57A1CAB8E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"profile":{"info_cache":{},"profile_counts_reported":"13369269838015595","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724796237"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2909d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.541431583223233
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtIdWmpIkayHt7ShdyikqeSJdXBuBuwBQja1olNhRpTXqu1QQRZ:YuBqDPafgWmpaydApdeYgBzBQjsopXTx
MD5:	2EEA0ACEF9AF248F3B75B2900623F37D
SHA1:	99809102DD85B27424CBE89155893E51E6D9A423
SHA-256:	5740EBD2204FE93AD235F777EE4C7E49826FF857220AEC39F20702576ADAFCC9
SHA-512:	E658F5871A09F25A70C2B536CBDF9E2D35548EAC2CFC912CAD362026930E3CEE19545564F66C1227DEA92033235D7E123AAAA07BC86E64D29BC734B57A1CAB8E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"profile":{"info_cache":{},"profile_counts_reported":"13369269838015595","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724796237"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2b78e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.541431583223233
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtIdWmpIkayHt7ShdyikqeSJdXBuBuwBQja1olNhRpTXqu1QQRZ:YuBqDPafgWmpaydApdeYgBzBQjsopXTx
MD5:	2EEA0ACEF9AF248F3B75B2900623F37D
SHA1:	99809102DD85B27424CBE89155893E51E6D9A423
SHA-256:	5740EBD2204FE93AD235F777EE4C7E49826FF857220AEC39F20702576ADAFCC9
SHA-512:	E658F5871A09F25A70C2B536CBDF9E2D35548EAC2CFC912CAD362026930E3CEE19545564F66C1227DEA92033235D7E123AAAA07BC86E64D29BC734B57A1CAB8E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"profile":{"info_cache":{},"profile_counts_reported":"13369269838015595","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724796237"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2f8ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.541431583223233
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtIdWmpIkayHt7ShdyikqeSJdXBuBuwBQja1olNhRpTXqu1QQRZ:YuBqDPafgWmpaydApdeYgBzBQjsopXTx
MD5:	2EEA0ACEF9AF248F3B75B2900623F37D
SHA1:	99809102DD85B27424CBE89155893E51E6D9A423
SHA-256:	5740EBD2204FE93AD235F777EE4C7E49826FF857220AEC39F20702576ADAFCC9
SHA-512:	E658F5871A09F25A70C2B536CBDF9E2D35548EAC2CFC912CAD362026930E3CEE19545564F66C1227DEA92033235D7E123AAAA07BC86E64D29BC734B57A1CAB8E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"profile":{"info_cache":{},"profile_counts_reported":"13369269838015595","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724796237"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF34dc3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.541431583223233
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtIdWmpIkayHt7ShdyikqeSJdXBuBuwBQja1olNhRpTXqu1QQRZ:YuBqDPafgWmpaydApdeYgBzBQjsopXTx
MD5:	2EEA0ACEF9AF248F3B75B2900623F37D
SHA1:	99809102DD85B27424CBE89155893E51E6D9A423
SHA-256:	5740EBD2204FE93AD235F777EE4C7E49826FF857220AEC39F20702576ADAFCC9
SHA-512:	E658F5871A09F25A70C2B536CBDF9E2D35548EAC2CFC912CAD362026930E3CEE19545564F66C1227DEA92033235D7E123AAAA07BC86E64D29BC734B57A1CAB8E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"profile":{"info_cache":{},"profile_counts_reported":"13369269838015595","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724796237"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF37a03.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.541431583223233
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtIdWmpIkayHt7ShdyikqeSJdXBuBuwBQja1olNhRpTXqu1QQRZ:YuBqDPafgWmpaydApdeYgBzBQjsopXTx
MD5:	2EEA0ACEF9AF248F3B75B2900623F37D
SHA1:	99809102DD85B27424CBE89155893E51E6D9A423
SHA-256:	5740EBD2204FE93AD235F777EE4C7E49826FF857220AEC39F20702576ADAFCC9
SHA-512:	E658F5871A09F25A70C2B536CBDF9E2D35548EAC2CFC912CAD362026930E3CEE19545564F66C1227DEA92033235D7E123AAAA07BC86E64D29BC734B57A1CAB8E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"profile":{"info_cache":{},"profile_counts_reported":"13369269838015595","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724796237"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3a152.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.541431583223233
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtIdWmpIkayHt7ShdyikqeSJdXBuBuwBQja1olNhRpTXqu1QQRZ:YuBqDPafgWmpaydApdeYgBzBQjsopXTx
MD5:	2EEA0ACEF9AF248F3B75B2900623F37D
SHA1:	99809102DD85B27424CBE89155893E51E6D9A423
SHA-256:	5740EBD2204FE93AD235F777EE4C7E49826FF857220AEC39F20702576ADAFCC9
SHA-512:	E658F5871A09F25A70C2B536CBDF9E2D35548EAC2CFC912CAD362026930E3CEE19545564F66C1227DEA92033235D7E123AAAA07BC86E64D29BC734B57A1CAB8E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"profile":{"info_cache":{},"profile_counts_reported":"13369269838015595","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724796237"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF4024e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.541431583223233
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtIdWmpIkayHt7ShdyikqeSJdXBuBuwBQja1olNhRpTXqu1QQRZ:YuBqDPafgWmpaydApdeYgBzBQjsopXTx
MD5:	2EEA0ACEF9AF248F3B75B2900623F37D
SHA1:	99809102DD85B27424CBE89155893E51E6D9A423
SHA-256:	5740EBD2204FE93AD235F777EE4C7E49826FF857220AEC39F20702576ADAFCC9
SHA-512:	E658F5871A09F25A70C2B536CBDF9E2D35548EAC2CFC912CAD362026930E3CEE19545564F66C1227DEA92033235D7E123AAAA07BC86E64D29BC734B57A1CAB8E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"profile":{"info_cache":{},"profile_counts_reported":"13369269838015595","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724796237"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlKlB/:Ls3Kl
MD5:	987F95C1FB5D48258C520CC8B7F48D2A
SHA1:	2599C4105215820E20006C250EE31D0AFC76047E
SHA-256:	639BFC1649CC75AF611026CAA2ED538869D9D293357BC3E65609093F806C9649
SHA-512:	3F5AB0A557390BB570C1769AE366948ABC402BAAB382366C57690391CCDD9B01BB2E796E7F3D66E0827B8A246D24EEB81AF619E6796FE8B3039A5911496B0037
Malicious:	false
Preview:	........................................V.G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ad710bd6-f075-4414-b35a-e73e95628b5f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.064754865240784
Encrypted:	false
SSDEEP:	384:LtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaV8NBSLAGWFTcu00jGX4KXH:hM7X2zt1jKYqHkZeM/UFTcu034K3
MD5:	D6EAF78E5366C408620E5EE29F6DDDB5
SHA1:	6DDBA34E70482F77DA21C3F55E651627FE94D1DB
SHA-256:	EB01E9FA6F064197F7C4D7EB703D750F1975109491C31D75E05FC2167A6DB629
SHA-512:	7CFC2B201B29FA6DA93D00A53FE7A5D63E5CBC43B544932FB1B8D71BB8352817D8C6210112F561F11EC62811178F4824EB8A60F76A271E35C41637EDA77046D4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369269840385842","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\b21175a6-798e-4d26-8a9c-f99189368ceb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71318
Entropy (8bit):	6.073617130030184
Encrypted:	false
SSDEEP:	1536:hMSzvKYqstGuprTdaV9vId2JSqC62FANspT4liwzEu9qk:hMS2dKGytQ9U2EqCNFnpZwzEu9qk
MD5:	FEE045360E3C0B68A8E25BCFA3DEF241
SHA1:	CE7D01D8F55770F74C9501DD941649D8D0BA6813
SHA-256:	13B4EA8FB8F5B699C10A91548AB2A40EF41A3908D89632744348A6247F4DE438
SHA-512:	32760B9865C7DB94CCCB9F00BE6B92CB8BD468306B5AAA3DA31DFF75CA95A1672E38D8B0A28F628DE54BCB0C7477FB231970599C1ED8628AAAF18AB8458DDE95
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369269840385842","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ba425292-14c6-4114-a151-0eccb4a9e13e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71357
Entropy (8bit):	6.0736864681918865
Encrypted:	false
SSDEEP:	1536:hMSzvKYqstvuprTdaV9vId2JSqC62FANspT4liwzEu9qk:hMS2dKvytQ9U2EqCNFnpZwzEu9qk
MD5:	AB3681AC04230BFDBBFA8205FD605C2C
SHA1:	C47D1A44D0591A3AE41C0C257878A5135519D078
SHA-256:	34427DBA70B9484545A1158EF5747B8EA118FAD1BC680B8A3E7918754C9A47B1
SHA-512:	6E1A19BC98F12ECD6B19EBE72784E8A45C35B0FF538BA1ABB3AF03E8E9387E69D4F6A27CFE20DAD47DDA99E6FCEA35E3D6779DFE1D290ED339CF333CC291E1DE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369269840385842","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\c4a33be2-d850-456c-af76-4311801da885.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.0647440980060425
Encrypted:	false
SSDEEP:	384:LtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaV8NBSLAkWFTcu00jGX4KXH:hM7X2zt1jKYqHkZeM/eFTcu034K3
MD5:	7E4A5C6A7E942857122B89112BC8691C
SHA1:	AFC587B3E7D9C2287F80070D3F76698130CFFEAE
SHA-256:	BA284C5AC237DCF2C9FD0A1E33824C3DE684B14EE88FB37EF30B20C0AEEAC25B
SHA-512:	44BCC6F1E3CD9CF47B04667D646F33F8298F68D9E15E66CD44252A922866C148AC6C741730ED310207E9FABAAC9674B931AC17C5763FCF32BD6D4E05615CB003
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369269840385842","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\e5f84551-a710-4925-8b08-fbf64c1ee8f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24324
Entropy (8bit):	6.054832170476639
Encrypted:	false
SSDEEP:	384:LtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaV8NGLAGWG/qdpVEwzs9xu9M00jGX4KXH:hM7X2zt1jKYqHkZeMZUGlwzs9xu9M03h
MD5:	F1AA93A4057CE2E0DE036160613E3558
SHA1:	4628DC578E58A73F1B6B2B739D35D94578E3B9DF
SHA-256:	E51175110B57F5B0BF3F605624925B419D66643A7C40C41978C64DAF12F6C81D
SHA-512:	01AB8F7049C200418890C94BAA84DF86913DCAA68B4F36EBB1D6BA43422D5C8F4D5E775FBCEC748FAACCCFCAF58E35110B75B297C501238D6BA8C1A5DE0AF7B8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369269840385842","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\f5de82f6-798f-4edd-878f-838e2effd48b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.541431583223233
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtIdWmpIkayHt7ShdyikqeSJdXBuBuwBQja1olNhRpTXqu1QQRZ:YuBqDPafgWmpaydApdeYgBzBQjsopXTx
MD5:	2EEA0ACEF9AF248F3B75B2900623F37D
SHA1:	99809102DD85B27424CBE89155893E51E6D9A423
SHA-256:	5740EBD2204FE93AD235F777EE4C7E49826FF857220AEC39F20702576ADAFCC9
SHA-512:	E658F5871A09F25A70C2B536CBDF9E2D35548EAC2CFC912CAD362026930E3CEE19545564F66C1227DEA92033235D7E123AAAA07BC86E64D29BC734B57A1CAB8E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA+W2mu4PlWLvK2A53/UkV7zxVv6+PYPybzrA39dyBydgAAAAAOgAAAAAIAACAAAAARawfBhtJCCXFFi+QhDT6ukW9b09n1P49VM7fdG9dEwzAAAACTs1Flpp5BQ8CxlEOJZ0sKATjq7619quzjShcs/FfIUh6e3iSWX3xIgww9IYQJzahAAAAAuJWIQiJTE0Hy4as7qme7FDJP0GxtTvv6iFUJYzJV0ZlARobhs8gu27cPdG+fATKPhX+fJDR0PhwZ45oUbAzU1A=="},"profile":{"info_cache":{},"profile_counts_reported":"13369269838015595","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724796237"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\04cba3d6-9a24-4ec1-a78c-46a48276659d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46790
Entropy (8bit):	6.0821914412691775
Encrypted:	false
SSDEEP:	768:fM7X2zt1jKYqHkZeM0dDGOlZvBhTIWIW+tbWSFegvnE7GUQzeqVlzng034Kp:fMSzvKYqst0dhvBjIW6HFezSeOlzgy
MD5:	A7AD28EC7C58034C3184CB14EEFEE3F5
SHA1:	CFCC465D9E3EECE62A8E088FD0FC3E31C752E617
SHA-256:	B2B26F1AA2AB93DF58C8629AFFF075882F983E2D0B9FFCA1EDD2673A87D73A34
SHA-512:	BDBDEEF1DB693380BDBD52B0825DEC336BB918CF0DCAF35517EF7FB66FE541E083E20178871779AAA37AECF6D68798675F89E8D0639845E06E391F6CA58197E7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369269856170667","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5b02e81a-b876-42e0-998f-5d81b453badf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24685
Entropy (8bit):	6.053134424538977
Encrypted:	false
SSDEEP:	384:1tM7XKnG7EtlXrjYJUoLUJqHsdZsJHaVsNO5dEUEXO+azdlznHU00jGX4KX5:fM7X2zt1jKYqHkZeM/dDGOVlzn0034Kp
MD5:	7983C29EA77CA1E3A61394C4A14AC9E5
SHA1:	7306FF834F01C3E4460200AB9432923A16898D47
SHA-256:	79BD75604E0666C044D28C2471EB2C5084FAF10EAE1BF284AB00523B874413B8
SHA-512:	68FBFA822CD372D0EECC5A78C534F0B656EFE2A59BDE0650CE41D16A7A2402D48F492F9959578E46542D918CC545F05063588AF22CE628DDBD398EC556FB4101
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369269856170667","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\78e86e83-2e9f-42c4-9584-3374319baccd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8256886b-8547-4447-8095-be11878367c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46751
Entropy (8bit):	6.082298212488959
Encrypted:	false
SSDEEP:	768:fM7X2zt1jKYqHkZeM/dDGOlZvBhTIWIW+tbWSFegvnE7GUQzeqVlzng034Kp:fMSzvKYqst/dhvBjIW6HFezSeOlzgy
MD5:	23A86D9C5D15CC5DC1D60E6527A21283
SHA1:	FE8F88094B30C98EA853A58EDF02A7004ED23744
SHA-256:	A4C9C28FB62F3EDDBFDD73BF0F944787B8E427766A8F9F4BE60BA57EB990885C
SHA-512:	6B308FD2C36027259ED5CAEF35F6B94C0ACABC362726423AD3F4EA435A11B3CB83EC5974741AEC47D12C2618FADD26C2CB235575BF448FCAF0B8BBDD0287FB70
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369269856170667","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8962f97b-f5d6-470c-b3ac-978ac58674b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.8331890391370305
Encrypted:	false
SSDEEP:	192:fsNwIWZreiRUAO1tQ5zyikcr96qRAq1k8SPxVLZ7VTiB:fsNwIUfhm+5Ohcr96q3QxVNZTiB
MD5:	67D5535513622EF904F62D6105B79CEE
SHA1:	689567760338AD9B4B61D56EDEC5C4C54C9116CB
SHA-256:	CE0EACB6373133254A752D32545B5767244E331BAFC4645D96A6EE9B98CC0EE8
SHA-512:	11B3591D53688A9C64B34D40CBEC518D9D43E976FBF69D62661BC75C93E6EA0C77870B982247E65E9454091FA8C86A90CBA24767C21A0D9F560D289B0D4231EE
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8e626420-be7c-49b6-ba56-05ee0247669a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.833262440819423
Encrypted:	false
SSDEEP:	192:fsNwIWZreiRUAO1tQ5i1Rkcr96qRAq1k8SPxVLZ7VTiB:fsNwIUfhm+5GCcr96q3QxVNZTiB
MD5:	EA4D8A5F66422D814D8302E2188906A6
SHA1:	4C303081E075342EF1534801B76C6604036D69D3
SHA-256:	E21CC9D282F22EF3CCBBEDCDC514F5671867E501D12517E7804221197A7B98FC
SHA-512:	841616E3FF71D38178A0F003A5881D31F2CC561F20823E611D389DC1F9F72CD3E6EFC670D48108FA673AE19A9A7490566461CB0CAA24750BAE952A4FF7572018
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139867263744
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
MD5:	515BFDD0A8E03F491ED66894DAC7434B
SHA1:	00534E56EA194556D8E48772D2463BB291B567AC
SHA-256:	C76D8691C06568DE0108BAD3E4C5596E5B6DB4AF6864E0C4B57F3EE2C909FA18
SHA-512:	649D4F9FF7446C1DB4B16F6A4C9BEBF0A92A9E266898D653A11CBC44FCCDE8472D91758A624AA5D5A1B306DFA793E5F72370ED70514CB25312B76ACD605EA652
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\f214ca44-3003-4407-bba8-fb4077dcfc55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139867263744
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
MD5:	515BFDD0A8E03F491ED66894DAC7434B
SHA1:	00534E56EA194556D8E48772D2463BB291B567AC
SHA-256:	C76D8691C06568DE0108BAD3E4C5596E5B6DB4AF6864E0C4B57F3EE2C909FA18
SHA-512:	649D4F9FF7446C1DB4B16F6A4C9BEBF0A92A9E266898D653A11CBC44FCCDE8472D91758A624AA5D5A1B306DFA793E5F72370ED70514CB25312B76ACD605EA652
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CE4D5F-1DAC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 256-0, spot sensor temperature 0.000000, unit celsius, color scheme 1, minimum point enabled, calibration: offset 134221824.000000, slope 75015551881388056232440365056.000000
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3113165203782382
Encrypted:	false
SSDEEP:	3072:AkfkhDwXh95F7Xl0ecsMbvUk3lYUERsFi8Hc6TSYT1jY8KD7URMqgPgf+9BdlRpU:oCblxQRFi8x+lRpVaHYF
MD5:	217B7268C270DCAC7240CCE7EA6E235F
SHA1:	75171ECE158399C5387CCD6E0D62BD411E8AC474
SHA-256:	D679DDFD9A95DAE4DF3D54921F73F44CCF2C23112740583CBAE00AF8F8B081AA
SHA-512:	1B586B4E28AEAD79AC7199387AECA56DD39AB8B2BF6829F53C07EA9B02641EC68805271A2F133D580B56BF8C4BCB1ED84935F35CCBF68BBDB6F64FC4AA2157D0
Malicious:	false
Preview:	...@..@...@.....C.].....@................O..pO..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".sssfol20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CE4D67-26C4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03974806285776951
Encrypted:	false
SSDEEP:	192:iQ0EbtmqvDtKX7hJEa3XxxTVwg7XGiV0DA5DhAVN/K+O1gQtW3r1q01n8y08TcmQ:50Et2eQtPnhUHagN3pX108T2RGOD
MD5:	7EB15A236D77A1A62AA8BAD85F28B2AF
SHA1:	828F7CC6F7FA00FB088465512C98F002C714A45E
SHA-256:	DD366655942715BA7A595EAAD4C61BD91ACF53EFA40B01612BF7E79A0B52297A
SHA-512:	294E0960212347F8A80B4B3C75E9687B25A6856F34D85745A556708FA2880BFE924517CF9D99442CE7DFD7399446C8C09AD2BC345A9C620EC9D37C576CF46FD2
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".sssfol20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CE4D6F-1C9C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.038773403315218946
Encrypted:	false
SSDEEP:	192:0r0EbtmqvD3KX7RJEa3Xxx7UpXxgg6zfhj1NEzHDtB1gQMIEO8Oqln8y08Tcm2Rl:A0EtYeZVQh54BDg0ESS08T2RGOD
MD5:	5749D213B58EA3350EE48A9529F24ADA
SHA1:	B178DFDCB96F47229A2D2FBF3AC49FE45D6D2A9B
SHA-256:	566D728E9387282DCB07A1468F33A71A5DBE0E1DF2B181AC00F5F2C4BDEE1627
SHA-512:	0E5E54BD71129D2BFBADD28C2513561D0448C165EC377384BD63E13E42E6FD81204ACFA6C60D17FFB8AA681BE500E40C26FEF3ED819F3EC748AE5F071442D86F
Malicious:	false
Preview:	...@..@...@.....C.].....@................\..PL..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".sssfol20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CE4D7D-25C4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03916042531004777
Encrypted:	false
SSDEEP:	192:Um0EbtmqvDHKX7VJX3BhESXBtghwwhTlNEdbJvs1gQM8YJ7bqYn8y08Tcm2RGOdB:h0Et8eX7h5gtMgIY1n08T2RGOD
MD5:	8B300178502E9499E64F2464C55D45BB
SHA1:	431A38CAB9E19ED1E4B84652084857CFD57A20B9
SHA-256:	D7E17A9411BE696D843263139DA7CB7AC38A58ACACB131CF533BE76A0A2B36D8
SHA-512:	5EA8E4439F5E1BA69FB5CC7FDBC3E426412C85FD1AF2F6AABFC71A49792F5D61F2973292E2CF23C884C1EC52466361ED163BCA0B95EF50C0B11C1E34E6456373
Malicious:	false
Preview:	...@..@...@.....C.].....@................^...N..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".sssfol20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\290c3cc7-b4ed-4050-9111-1b7310b08ead.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30244
Entropy (8bit):	5.5660247161489815
Encrypted:	false
SSDEEP:	768:F4eo4l7pLGLvz6WP/vf6A8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFX4Sb+GrwDCkpe:F4eo4zcvz6WP/vf6Au1jaQX4G+DDtY
MD5:	E17546C71A31C386C1973F23BB03EFB6
SHA1:	BB09165CCBB1F47F2AE0CECB8B58E066DBAB8283
SHA-256:	A4FB45375248D4772C36FED28FBEB5E7E1CA630E694B35142727D6E5797E25F6
SHA-512:	B6D808133331FADD954D1A78FA4E8FB87F99E125D691F4D0AFC4A5D59C4DE8695D6A41AC8A1CD689F3C81396392823B67011F033A798B2D5155C41A2432C5AF0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369269855863693","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369269855863693","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\611535fd-4262-4f6a-9113-6aad477ffb5e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6ca138a7-8668-4634-8e30-d47061df75af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557687378670723
Encrypted:	false
SSDEEP:	768:F4eo4l7pLGLvz6WP/vfpA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnSb+GrwDCrpXtd:F4eo4zcvz6WP/vfpAu1jauG+D2td
MD5:	EC733AD602C65BF5187A6BD7C88C0CB8
SHA1:	F037FB252B35DEDF2C1C07568230281C0F7FDB68
SHA-256:	5F637B4C04A06CB28290E7A5AB796CDADC0AFA0AB177AEF08D7D871AD558BBFD
SHA-512:	70C2F710CE8DF5EC96537322FFDCD3B9EF0141E14E672060001732C85D46F2344A15C3F97EBE08C371269D6430DDE1D8103EA1EA3FFFFCC690D135914EC5385B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369269855863693","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369269855863693","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9dceac80-e23c-45c5-8946-ac22db384a30.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321219963168266
Encrypted:	false
SSDEEP:	192:4AOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:7OEOKSXs/J7mGnQmLu5/5eNdl
MD5:	E6A484D1188EEECAFCF48BAF1B088A90
SHA1:	15283B83831AF20196E7C586D68B41784C8FDE47
SHA-256:	28DE5A37111D36620541A673B676332C2AE1EA08AB1D1DC54C5938C85E0F2C4F
SHA-512:	D98742CD32BEBBECCD980F3D429EC8F55438205D42954BBC7BCBF4C6966F142D35348E8E3C98468EDCDF5B00989CC7AACE634472F688811FCAE24D1EB4171823
Malicious:	false
Preview:	...m.................DB_VERSION.1/...................QUERY_TIMESTAMP:arbitration_priority_list4...13369269858847114.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.100963601569098
Encrypted:	false
SSDEEP:	6:N7EzfU41kA1wkn23oH+Tcwt9Eh1ZB2KLlL7EzfUImv4q2Pwkn23oH+Tcwt9Eh1th:N721wfYeb9Eh1ZFL17pAvYfYeb9Eh16g
MD5:	755EB56702E4C2FC847847480DF2F415
SHA1:	63A1EECB803C369A1859094C9A693E3DD5144924
SHA-256:	FD444E15746B9E03F586C83E0A450751698D6020B7BB5102144058774E8C4988
SHA-512:	D8853DCBBF886725897BB1EF4D492ADF9BD28D7B493D723DFE8405B25E4F57EFF8F9602BCFE23EE5D4942A5A1DF2E1FFAFDEB90FFA02193AEED9CE440F121D46
Malicious:	false
Preview:	2024/08/27-18:04:17.467 2450 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/27-18:04:18.021 2450 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNluVzKl:Ls3ut
MD5:	524836CB6571B33AFFBF08FF4F2E9DD9
SHA1:	1C8F52B8800ED6C95F731B2EA6D33BA647961892
SHA-256:	C5D25A401886B866726324368E56416C5395037A5BC0539F914A6DD30201792F
SHA-512:	98159DE2EE5F2E7CF857859581E0A919C786EDB64BAB59A0C9054119921488974AEA9BA3EA1638B3AE18F230E8099C4726755B0E550161482086A65435493929
Malicious:	false
Preview:	........................................1"..G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.18063497106099
Encrypted:	false
SSDEEP:	6:N7EzfUMVR1wkn23oH+TcwtnG2tbB2KLlL7EzfU0I9yq2Pwkn23oH+TcwtnG2tMsh:N7ZfYebn9VFL17eIAvYfYebn9GFUv
MD5:	C9CFC4998B98208C9783FFEEE1603A58
SHA1:	3F7E82A7F697E896F3817E9ECB8B0AAEF30D4B97
SHA-256:	51255B3C574A312259593791E46B2AECDE806AA54D8177A4D36CB75409008F04
SHA-512:	4661C55765769C960D7D91B6950C5C3568B680206A56889F4AEA6C71EE4E1444BB9182B6B57689CB71CDA1824938BC541DAC47D4B8F48EB1FC1231F9412027D3
Malicious:	false
Preview:	2024/08/27-18:04:16.086 2270 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/27-18:04:16.100 2270 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.138428683234282
Encrypted:	false
SSDEEP:	6:N7EzfUNhq1wkn23oH+Tcwt8aVdg2KLlL7EzfUiq2Pwkn23oH+Tcwt8aPrqIFUv:N7N1fYeb0L17kvYfYebL3FUv
MD5:	959E2A14D968BFB088B30CEC71F6636F
SHA1:	7861DD6861DCA27A6D3CFA5C19FA55C24E6F9365
SHA-256:	0FA55AF3CBDC4F1FB4BB84674E738EF1A2FCBE6AD0F1CA0213E3EB5AD8E7CCA2
SHA-512:	2D6F577C091F5CCDAE24D8904CE36682B85CC211362780BCC01E7396AB04F66740D39AC1D7B575C2CC8AF09A88255E64070B6AF1861DFF4AD37ACB547C64CE8A
Malicious:	false
Preview:	2024/08/27-18:04:16.087 2240 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/27-18:04:16.101 2240 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.14320409148531
Encrypted:	false
SSDEEP:	6:N7EzfU2shq1wkn23oH+Tcwt86FB2KLlL7EzfU8q2Pwkn23oH+Tcwt865IFUv:N7x1fYeb/FFL17KvYfYeb/WFUv
MD5:	3C5C0E3BEC9DD018A11A9DC055325954
SHA1:	A1899B042E3FEA5F3111525F14C95BFB5D01EE51
SHA-256:	C31884F5D4A64649FAE80786532BD463209BA9C7DE37B1867199919F4080327B
SHA-512:	4946394390261C06B4E44379F4C796166B5BE1C372B4F526615D7889EB0974BE9D929898BAB41A91396B7F7BFD2B038B7268347A0F73CDEE4B2EDCC52F15D1E8
Malicious:	false
Preview:	2024/08/27-18:04:16.102 2240 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/27-18:04:16.169 2240 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.177240293091826
Encrypted:	false
SSDEEP:	6:N7EzfUmQ3+q2Pwkn23oH+Tcwt8NIFUt887EzfUm2HqZmw+87EzfUm2HGVkwOwknV:N7fOvYfYebpFUt8870/+8705JfYebqJ
MD5:	DD9932A0E880FCE0D8A8707BD5177C28
SHA1:	DCD35CAB12D38B3DF92A431428A66E05F972FE0E
SHA-256:	3D577F7B32BFA80DF0B5E686B1F326BD1535094B813ED3375E08E02B16795B8A
SHA-512:	45402B34C2AF8098C12E907259477B0D61B7D8D27FFF719C364B3EC19475F87F01EA9DCF055AB760ACC3E8DECF603B568122959F6CE98D92785CD9DCFFEACF8D
Malicious:	false
Preview:	2024/08/27-18:04:16.236 2238 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/27-18:04:16.237 2238 Recovering log #3.2024/08/27-18:04:16.237 2238 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.177240293091826
Encrypted:	false
SSDEEP:	6:N7EzfUmQ3+q2Pwkn23oH+Tcwt8NIFUt887EzfUm2HqZmw+87EzfUm2HGVkwOwknV:N7fOvYfYebpFUt8870/+8705JfYebqJ
MD5:	DD9932A0E880FCE0D8A8707BD5177C28
SHA1:	DCD35CAB12D38B3DF92A431428A66E05F972FE0E
SHA-256:	3D577F7B32BFA80DF0B5E686B1F326BD1535094B813ED3375E08E02B16795B8A
SHA-512:	45402B34C2AF8098C12E907259477B0D61B7D8D27FFF719C364B3EC19475F87F01EA9DCF055AB760ACC3E8DECF603B568122959F6CE98D92785CD9DCFFEACF8D
Malicious:	false
Preview:	2024/08/27-18:04:16.236 2238 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/27-18:04:16.237 2238 Recovering log #3.2024/08/27-18:04:16.237 2238 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3275680293422497
Encrypted:	false
SSDEEP:	6:eyA/J3+t76Y4QZZofU99pO0BY4qR4EZY4QZvGy:YhHQws9LdCBQZGy
MD5:	38E157AD81D0F699244B1F4D4CEC74B9
SHA1:	7651A3ACEBE6A1F4DDA8BCC30D336B3631A853E4
SHA-256:	CA4A104AA0BFC5CC7DA7F65468757CCE36A2DE495D23CE7DA47B927F9645ADB7
SHA-512:	9409034918A34B3CF5FC441570BA2B56E4B10E177EDB6029A2DC7E190EEA537788B94DB99ED0DE28900BB0D405FC88F070CD7151C61A34BE91041E2E2D1C8C26
Malicious:	false
Preview:	............V].r...'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.248400085986584
Encrypted:	false
SSDEEP:	12:N72Bmi+vYfYeb8rcHEZrELFUt8872B0/+872BUV5JfYeb8rcHEZrEZSJ:N/TYfYeb8nZrExg88BDJfYeb8nZrEZe
MD5:	9A34010AB82905C18DDC9E3BE19D8E81
SHA1:	CC05B56C647BB2475108D860C25B12C2066C4273
SHA-256:	6BE965077FF2FAAFDF2F1EBE70946FDBCDA29DD9C299F544FEA2FC48FC8D4A4E
SHA-512:	75D4303A58EFFE99793C5C584858FAD39A5500806FC874D68C9F93CE783612E4E89BC0640C7B171D2318A943B98D72FDD2545521CC7C9F72E9F18FC172EB0A9D
Malicious:	false
Preview:	2024/08/27-18:04:17.247 1ebc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/27-18:04:17.248 1ebc Recovering log #3.2024/08/27-18:04:17.248 1ebc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.248400085986584
Encrypted:	false
SSDEEP:	12:N72Bmi+vYfYeb8rcHEZrELFUt8872B0/+872BUV5JfYeb8rcHEZrEZSJ:N/TYfYeb8nZrExg88BDJfYeb8nZrEZe
MD5:	9A34010AB82905C18DDC9E3BE19D8E81
SHA1:	CC05B56C647BB2475108D860C25B12C2066C4273
SHA-256:	6BE965077FF2FAAFDF2F1EBE70946FDBCDA29DD9C299F544FEA2FC48FC8D4A4E
SHA-512:	75D4303A58EFFE99793C5C584858FAD39A5500806FC874D68C9F93CE783612E4E89BC0640C7B171D2318A943B98D72FDD2545521CC7C9F72E9F18FC172EB0A9D
Malicious:	false
Preview:	2024/08/27-18:04:17.247 1ebc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/27-18:04:17.248 1ebc Recovering log #3.2024/08/27-18:04:17.248 1ebc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.221759486875701
Encrypted:	false
SSDEEP:	6:N7EzfUtN+q2Pwkn23oH+Tcwt8a2jMGIFUt887EzfUPZmw+87EzfUNVkwOwkn23oL:N7/N+vYfYeb8EFUt887F/+87fV5JfYek
MD5:	CA99F6CE693ADB14DBA88567278A97C1
SHA1:	A41B9257D24F827B10D199462B30A18770C17D56
SHA-256:	CE660CA695A5843698BD56219AB9BD51D20D189D2025BFF604E1364087C618EE
SHA-512:	7B769B48D5F5467BBA39E139F10EC9EA299937A6F7AAE6A69D1A102878824FFEE1DF55120169AB6021D5B72EC80827B71C97C775E82E12AE7322F3C0EF7AC56A
Malicious:	false
Preview:	2024/08/27-18:04:16.749 74c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/27-18:04:16.756 74c Recovering log #3.2024/08/27-18:04:16.765 74c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.221759486875701
Encrypted:	false
SSDEEP:	6:N7EzfUtN+q2Pwkn23oH+Tcwt8a2jMGIFUt887EzfUPZmw+87EzfUNVkwOwkn23oL:N7/N+vYfYeb8EFUt887F/+87fV5JfYek
MD5:	CA99F6CE693ADB14DBA88567278A97C1
SHA1:	A41B9257D24F827B10D199462B30A18770C17D56
SHA-256:	CE660CA695A5843698BD56219AB9BD51D20D189D2025BFF604E1364087C618EE
SHA-512:	7B769B48D5F5467BBA39E139F10EC9EA299937A6F7AAE6A69D1A102878824FFEE1DF55120169AB6021D5B72EC80827B71C97C775E82E12AE7322F3C0EF7AC56A
Malicious:	false
Preview:	2024/08/27-18:04:16.749 74c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/27-18:04:16.756 74c Recovering log #3.2024/08/27-18:04:16.765 74c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\16b74cd8-4fc9-4279-a239-b7e00d43c7fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\24f0dbde-9a8a-4288-a479-8aa158e45a7d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5d3a8170-343c-4595-99a9-f5ce3411f79a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\76bf25ab-9fe6-43b0-a070-1f931c23d8f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\83b08557-db3c-4018-b7f3-81527ca5cec1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3003f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3ed9d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2db52.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2e814.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF3003f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a54b5550-4a2f-444c-ad82-3de259bad45f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.307046555170956
Encrypted:	false
SSDEEP:	24:YXsXZVMdBsGZFRudFGcsyZFGJ/dbG7nby:YXsJ8sSfcdsmgzbZ
MD5:	0727D1C5F85F9CD1632F83D5E7E18503
SHA1:	E5318EE32D1638AF154575A1D441CD7FA9C74931
SHA-256:	9BB19262B86429D11F1257EBD422F4473D2F6F1FF4C57EB21ACC518996377596
SHA-512:	63B5B282807BB252C163A660E8204FB83CF03FC8616C9D6EB56E2FC0251424E9DC6AF8600EB0EEECA9575504B4348D1EEAAA34B85CC842045E2A94EFE979F184
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371861858112217","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371861859207814","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371861862187255","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cbecca27-75e8-4c2a-b1c3-462ccee42a00.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.0705725982271215
Encrypted:	false
SSDEEP:	96:sVXqlLJ1Bb9tQxiAbOX1sXtYwsY5Th6Cp9/x+6M8muecmAeCke4zvril2X6gE5Ak:sVXwJ0xiAbOF6tYwsYPpj+FVA6ilFBf
MD5:	C8966B32EA50460A505AC8285196E38C
SHA1:	2D8D95AFC137AFBC4B56A94447BD987CFE6E75CD
SHA-256:	FCA0DC5A22682718118E214A7D94A96030DD67B7134F1C99766BA03CC9012B66
SHA-512:	1C14E6B02D1298EE366293AFBADFEB2215401602F94162DB7D97EBA8DAAF5398650B7389230FF13152AC94F345D5711D640849DB2C5868683B45AB3D02A8B7DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369269856116968","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF33019.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.0705725982271215
Encrypted:	false
SSDEEP:	96:sVXqlLJ1Bb9tQxiAbOX1sXtYwsY5Th6Cp9/x+6M8muecmAeCke4zvril2X6gE5Ak:sVXwJ0xiAbOF6tYwsYPpj+FVA6ilFBf
MD5:	C8966B32EA50460A505AC8285196E38C
SHA1:	2D8D95AFC137AFBC4B56A94447BD987CFE6E75CD
SHA-256:	FCA0DC5A22682718118E214A7D94A96030DD67B7134F1C99766BA03CC9012B66
SHA-512:	1C14E6B02D1298EE366293AFBADFEB2215401602F94162DB7D97EBA8DAAF5398650B7389230FF13152AC94F345D5711D640849DB2C5868683B45AB3D02A8B7DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369269856116968","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF36f55.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.0705725982271215
Encrypted:	false
SSDEEP:	96:sVXqlLJ1Bb9tQxiAbOX1sXtYwsY5Th6Cp9/x+6M8muecmAeCke4zvril2X6gE5Ak:sVXwJ0xiAbOF6tYwsYPpj+FVA6ilFBf
MD5:	C8966B32EA50460A505AC8285196E38C
SHA1:	2D8D95AFC137AFBC4B56A94447BD987CFE6E75CD
SHA-256:	FCA0DC5A22682718118E214A7D94A96030DD67B7134F1C99766BA03CC9012B66
SHA-512:	1C14E6B02D1298EE366293AFBADFEB2215401602F94162DB7D97EBA8DAAF5398650B7389230FF13152AC94F345D5711D640849DB2C5868683B45AB3D02A8B7DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369269856116968","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3e485.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.0705725982271215
Encrypted:	false
SSDEEP:	96:sVXqlLJ1Bb9tQxiAbOX1sXtYwsY5Th6Cp9/x+6M8muecmAeCke4zvril2X6gE5Ak:sVXwJ0xiAbOF6tYwsYPpj+FVA6ilFBf
MD5:	C8966B32EA50460A505AC8285196E38C
SHA1:	2D8D95AFC137AFBC4B56A94447BD987CFE6E75CD
SHA-256:	FCA0DC5A22682718118E214A7D94A96030DD67B7134F1C99766BA03CC9012B66
SHA-512:	1C14E6B02D1298EE366293AFBADFEB2215401602F94162DB7D97EBA8DAAF5398650B7389230FF13152AC94F345D5711D640849DB2C5868683B45AB3D02A8B7DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369269856116968","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557687378670723
Encrypted:	false
SSDEEP:	768:F4eo4l7pLGLvz6WP/vfpA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnSb+GrwDCrpXtd:F4eo4zcvz6WP/vfpAu1jauG+D2td
MD5:	EC733AD602C65BF5187A6BD7C88C0CB8
SHA1:	F037FB252B35DEDF2C1C07568230281C0F7FDB68
SHA-256:	5F637B4C04A06CB28290E7A5AB796CDADC0AFA0AB177AEF08D7D871AD558BBFD
SHA-512:	70C2F710CE8DF5EC96537322FFDCD3B9EF0141E14E672060001732C85D46F2344A15C3F97EBE08C371269D6430DDE1D8103EA1EA3FFFFCC690D135914EC5385B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369269855863693","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369269855863693","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF328c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557687378670723
Encrypted:	false
SSDEEP:	768:F4eo4l7pLGLvz6WP/vfpA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnSb+GrwDCrpXtd:F4eo4zcvz6WP/vfpAu1jauG+D2td
MD5:	EC733AD602C65BF5187A6BD7C88C0CB8
SHA1:	F037FB252B35DEDF2C1C07568230281C0F7FDB68
SHA-256:	5F637B4C04A06CB28290E7A5AB796CDADC0AFA0AB177AEF08D7D871AD558BBFD
SHA-512:	70C2F710CE8DF5EC96537322FFDCD3B9EF0141E14E672060001732C85D46F2344A15C3F97EBE08C371269D6430DDE1D8103EA1EA3FFFFCC690D135914EC5385B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369269855863693","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369269855863693","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.1601924017784055
Encrypted:	false
SSDEEP:	6:N7EzfWutSs+q2Pwkn23oH+TcwtrQMxIFUt887EzfWul3Zmw+87EzfWuhiVkwOwkE:N7nugs+vYfYebCFUt887nul3/+87nu8p
MD5:	C6CAD0C9DC52802B47C5DC6A6641B7C8
SHA1:	091D6BD3E6399CFC117F51BE45B3EC7A2F00670B
SHA-256:	9B3FE1DE024B513B6BFF3303CE59F655F5552CC8A7982112C6F5D43FCCB12645
SHA-512:	E308C568904AFEB9051036F47986658F0752257811D59AE770E96E4E95B910655AA883576086CE888188EE0AF97E083C0A9BC0D68252E41FE3AB1D445894E2DF
Malicious:	false
Preview:	2024/08/27-18:04:31.888 74c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/27-18:04:31.891 74c Recovering log #3.2024/08/27-18:04:31.894 74c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.1601924017784055
Encrypted:	false
SSDEEP:	6:N7EzfWutSs+q2Pwkn23oH+TcwtrQMxIFUt887EzfWul3Zmw+87EzfWuhiVkwOwkE:N7nugs+vYfYebCFUt887nul3/+87nu8p
MD5:	C6CAD0C9DC52802B47C5DC6A6641B7C8
SHA1:	091D6BD3E6399CFC117F51BE45B3EC7A2F00670B
SHA-256:	9B3FE1DE024B513B6BFF3303CE59F655F5552CC8A7982112C6F5D43FCCB12645
SHA-512:	E308C568904AFEB9051036F47986658F0752257811D59AE770E96E4E95B910655AA883576086CE888188EE0AF97E083C0A9BC0D68252E41FE3AB1D445894E2DF
Malicious:	false
Preview:	2024/08/27-18:04:31.888 74c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/27-18:04:31.891 74c Recovering log #3.2024/08/27-18:04:31.894 74c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.1741200790852995
Encrypted:	false
SSDEEP:	6:N7EzfUSN4q2Pwkn23oH+Tcwt7Uh2ghZIFUt887EzfULJZmw+87EzfULDkwOwkn20:N7tvYfYebIhHh2FUt8877/+87R5JfYeQ
MD5:	8BC11B74B9FDDA59D34F3FE8B6701EC8
SHA1:	9FFDFB14A0BC42FBAB50EC916B854B06F8BFD05D
SHA-256:	2049A7E879EC63D17D1D3C9A6ED743017AD28139785258E79C7050FCD60ED889
SHA-512:	9333EBF7CF079E8F3974E4B7D8069ED5F1F25FDA2B3577BE3333A7CA66CC9B13901E9793867CA9F6FBA208C4B42691D2BB091F867DA58FD573945C89A4AD3D38
Malicious:	false
Preview:	2024/08/27-18:04:16.028 2254 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/27-18:04:16.029 2254 Recovering log #3.2024/08/27-18:04:16.029 2254 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.1741200790852995
Encrypted:	false
SSDEEP:	6:N7EzfUSN4q2Pwkn23oH+Tcwt7Uh2ghZIFUt887EzfULJZmw+87EzfULDkwOwkn20:N7tvYfYebIhHh2FUt8877/+87R5JfYeQ
MD5:	8BC11B74B9FDDA59D34F3FE8B6701EC8
SHA1:	9FFDFB14A0BC42FBAB50EC916B854B06F8BFD05D
SHA-256:	2049A7E879EC63D17D1D3C9A6ED743017AD28139785258E79C7050FCD60ED889
SHA-512:	9333EBF7CF079E8F3974E4B7D8069ED5F1F25FDA2B3577BE3333A7CA66CC9B13901E9793867CA9F6FBA208C4B42691D2BB091F867DA58FD573945C89A4AD3D38
Malicious:	false
Preview:	2024/08/27-18:04:16.028 2254 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/27-18:04:16.029 2254 Recovering log #3.2024/08/27-18:04:16.029 2254 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsullra:LsQ
MD5:	9330738FC127C66B9D76534099C90685
SHA1:	7E9F34CC5B41DFB32AA665424D43446DEED4B688
SHA-256:	D057E256400C2A45CDD0203B3558DD94E7CD4CB0489FECC5F7126356DE84E2A9
SHA-512:	54069B75355F7C17AC6B3F533A0588F814E899FF95C03D0E0CBB514619185460C63029CB8C4CC53C9EFDB3BD20120ED1DE525A6F3B3A605AAA3E4A2B9F9BC85A
Malicious:	false
Preview:	............................................G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlvRUll:Ls3vRU/
MD5:	C84F1110781D1DDA20429A708C6B8A1F
SHA1:	1CD8AB4D7FF24B07BB11043485906C55B35B239A
SHA-256:	51951A69B90470E18326E8F90C14FEC99B3F3BE3B63C9B6F74428D41A8F1BB81
SHA-512:	BE0EB0CBB00E6DBC185E960D0EF7D82BF21B6E517CC70DC641BB45F82BF2014A2B9926B14AFB29F79B82F51B4C4C1A1AA35AED61A44E1E532C1E41C540427464
Malicious:	false
Preview:	.........................................O..G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.254342193796692
Encrypted:	false
SSDEEP:	12:N7wFl3+vYfYebvqBQFUt887OgX/+870FlV5JfYebvqBvJ:NkFlMYfYebvZg8866mJfYebvk
MD5:	DB21FF89972F4BFF73D5D4843484EA46
SHA1:	ADA0FB6B36BB488EF3B0CD6F0CA99C7763BC531B
SHA-256:	B971A7F69842C62C5D969A30EC42C6E360C7E9AC0D05DE255A4B8A87F18BA29A
SHA-512:	E3369642EC56FBF87908398B69DD1E38342C604D4B1C17B822BEE9197C7C8EE69EF07B79D0E0B6C4769D3AC1D1BE3AEBD26CEC2B0796B4BEC7DFA16D88E0A45C
Malicious:	false
Preview:	2024/08/27-18:04:16.780 74c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/27-18:04:16.781 74c Recovering log #3.2024/08/27-18:04:16.784 74c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.254342193796692
Encrypted:	false
SSDEEP:	12:N7wFl3+vYfYebvqBQFUt887OgX/+870FlV5JfYebvqBvJ:NkFlMYfYebvZg8866mJfYebvk
MD5:	DB21FF89972F4BFF73D5D4843484EA46
SHA1:	ADA0FB6B36BB488EF3B0CD6F0CA99C7763BC531B
SHA-256:	B971A7F69842C62C5D969A30EC42C6E360C7E9AC0D05DE255A4B8A87F18BA29A
SHA-512:	E3369642EC56FBF87908398B69DD1E38342C604D4B1C17B822BEE9197C7C8EE69EF07B79D0E0B6C4769D3AC1D1BE3AEBD26CEC2B0796B4BEC7DFA16D88E0A45C
Malicious:	false
Preview:	2024/08/27-18:04:16.780 74c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/27-18:04:16.781 74c Recovering log #3.2024/08/27-18:04:16.784 74c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4783fd12-ce93-491f-986e-e6c97336c158.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3fd7c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2e814.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a646fe33-60c7-4893-9a79-c8127dd3dac2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b9c74681-9221-4f35-b520-2537cab055f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d03b8fdf-4fdc-4f10-a85b-69c3eb5948b0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.237580189268515
Encrypted:	false
SSDEEP:	12:N7nhi+vYfYebvqBZFUt887nTR/+87nj3V5JfYebvqBaJ:NhYfYebvyg883XXJfYebvL
MD5:	103FB2E298C1FBD7121330EC8B778226
SHA1:	8B01D5087AA2CB2C043DA9A7EEE179C302DB9E61
SHA-256:	C9217187378CF4022F3D9884736B6BCA56E2AD11CD826732525920C367B01B35
SHA-512:	C278FF74EEC9CAFBD6882598B0239E4ABDE79E458834BA39B08F1AC0FB9FCDDA32E1B1155D8C1CD0A155BEE29CD0772D4E86A24A02A32787D0CD5412725404D5
Malicious:	false
Preview:	2024/08/27-18:04:32.016 74c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/27-18:04:32.017 74c Recovering log #3.2024/08/27-18:04:32.020 74c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.237580189268515
Encrypted:	false
SSDEEP:	12:N7nhi+vYfYebvqBZFUt887nTR/+87nj3V5JfYebvqBaJ:NhYfYebvyg883XXJfYebvL
MD5:	103FB2E298C1FBD7121330EC8B778226
SHA1:	8B01D5087AA2CB2C043DA9A7EEE179C302DB9E61
SHA-256:	C9217187378CF4022F3D9884736B6BCA56E2AD11CD826732525920C367B01B35
SHA-512:	C278FF74EEC9CAFBD6882598B0239E4ABDE79E458834BA39B08F1AC0FB9FCDDA32E1B1155D8C1CD0A155BEE29CD0772D4E86A24A02A32787D0CD5412725404D5
Malicious:	false
Preview:	2024/08/27-18:04:32.016 74c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/27-18:04:32.017 74c Recovering log #3.2024/08/27-18:04:32.020 74c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.229513383523389
Encrypted:	false
SSDEEP:	6:N7EzfUWr9+q2Pwkn23oH+TcwtpIFUt887EzfUWUFJZmw+87EzfUWPN9VkwOwkn2T:N7E4vYfYebmFUt887zJ/+87eD5JfYeb7
MD5:	0F39E0330C9E6BE2EC9F29985D440923
SHA1:	57792AE725FAE45DB6809C270703CAA9436C5382
SHA-256:	5632B5485F9AAF16E234C3625F1C947C42C4DB3C7A2FAE8C4950FA9080F33DB2
SHA-512:	8779F19E8E69D17C7E84726D4E56CF5495574B2F83C357D3918B0B8D51AD63EC4075411A1765BE91097C36039C8BB1386DBE1C64C2C057390FC237D172AD0053
Malicious:	false
Preview:	2024/08/27-18:04:16.090 1c68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/27-18:04:16.091 1c68 Recovering log #3.2024/08/27-18:04:16.092 1c68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.229513383523389
Encrypted:	false
SSDEEP:	6:N7EzfUWr9+q2Pwkn23oH+TcwtpIFUt887EzfUWUFJZmw+87EzfUWPN9VkwOwkn2T:N7E4vYfYebmFUt887zJ/+87eD5JfYeb7
MD5:	0F39E0330C9E6BE2EC9F29985D440923
SHA1:	57792AE725FAE45DB6809C270703CAA9436C5382
SHA-256:	5632B5485F9AAF16E234C3625F1C947C42C4DB3C7A2FAE8C4950FA9080F33DB2
SHA-512:	8779F19E8E69D17C7E84726D4E56CF5495574B2F83C357D3918B0B8D51AD63EC4075411A1765BE91097C36039C8BB1386DBE1C64C2C057390FC237D172AD0053
Malicious:	false
Preview:	2024/08/27-18:04:16.090 1c68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/27-18:04:16.091 1c68 Recovering log #3.2024/08/27-18:04:16.092 1c68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746027
Encrypted:	false
SSDEEP:	3:FC/l1lhtlF:q31
MD5:	FA93E277D26B65AECF6107B2C3A57B46
SHA1:	932E87DCE88B5FF9ECCA042F0BF4289F6D9691A1
SHA-256:	1FF898E4C31015540AC31D08FCCBC8E928A4C3E39378E52A4262DC907E5F902A
SHA-512:	EB795B5C781AC07DCDC70ADB9D9DE55661DFA6CB934022476F5642E1CF25F39FF3E828E65DA867FB6C1E51A8E7913B971A414F3B908A22AB45941040137DB24B
Malicious:	false
Preview:	.............l.4...W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a987a7d1-4283-4003-8cd0-1a5575db056a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.0705725982271215
Encrypted:	false
SSDEEP:	96:sVXqlLJ1Bb9tQxiAbOX1sXtYwsY5Th6Cp9/x+6M8muecmAeCke4zvril2X6gE5Ak:sVXwJ0xiAbOF6tYwsYPpj+FVA6ilFBf
MD5:	C8966B32EA50460A505AC8285196E38C
SHA1:	2D8D95AFC137AFBC4B56A94447BD987CFE6E75CD
SHA-256:	FCA0DC5A22682718118E214A7D94A96030DD67B7134F1C99766BA03CC9012B66
SHA-512:	1C14E6B02D1298EE366293AFBADFEB2215401602F94162DB7D97EBA8DAAF5398650B7389230FF13152AC94F345D5711D640849DB2C5868683B45AB3D02A8B7DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369269856116968","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d269d051-5c5c-4180-9d1c-e40dd7950807.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9161
Entropy (8bit):	5.1810484143496645
Encrypted:	false
SSDEEP:	192:sVXwJ0xiAbOF6U/yYwsYPpj+FVA6ilFBf:sVXwJ0d89/WpUVPiR
MD5:	48D9E1C0713E1855FEDD797C4D63B17F
SHA1:	B458822887640F3F2AC907B06062B409350365EF
SHA-256:	1FA27179166EF3DA61BA3B3BF36FCC720A2B0FF20779CF89F707E3845F0525F1
SHA-512:	822D864CE73CCFA7B1D7524A95052613C4B3015E6D4F7E8329DCF0D35AE53ECA176B63A5EB01189172DAFA081625557F9105B2014D4944380EC88C0583C7677A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369269856116968","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f5c0a251-d359-43c8-959b-974c8e1448ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9333
Entropy (8bit):	5.180320736373509
Encrypted:	false
SSDEEP:	192:sVXwJ0xiAbOF6U/yYwsYPpj+FVAOilFBf:sVXwJ0d89/WpUV3iR
MD5:	6F4AE4DB97BDA56DD45E57BBC7E409F5
SHA1:	71A02629FB8D3B5921A9FDB0ABE8BF57D6945F9F
SHA-256:	4C3CC7E6769190609BC0D237AA6ECB739EBD93FF9D2CCADB74EA909CF40FB155
SHA-512:	E2CFD8B51A861E1CD6BD88E23ECD17681B81B7D28B8B39ACB977F664EF11A959AF2ABBBD276CE470152B0F464A5EDB0A9D04C7E413F85F2576A292B0B013300C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369269856116968","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f652df2e-8ed4-40d3-8100-a62a2eac86b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9295
Entropy (8bit):	5.181695452197524
Encrypted:	false
SSDEEP:	192:sVXwJ0xiAbOF6U/yYwsYPpj+FVAfilFBf:sVXwJ0d89/WpUVqiR
MD5:	F94E8CBD9931F7E80CFEB1B71062AC44
SHA1:	29F246D407100136606F65EF8737B14801707E2C
SHA-256:	725D40B7529C5F9A7DA6B9113C0B216D191E2BA84638A71164FFE2905C98E524
SHA-512:	115E2DB9E66D0CE29AEC6B4542A40DCCFB8C5BE9D6F59DF6FADD43D19ED9C5305D2A35A940FF06F17775FBFF752431F50BD86AE1AD8077146B2E7DC7B303FEC4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369269856116968","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.333168017378757
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQvxlcl/l3seGKT9rcQ6xADztl:/XntM+4lcl/l3sedhOmz
MD5:	42C0AD338F0CF18739955CDD75C071C4
SHA1:	CBF017A6BDC61BB263EBAF9A729FF9273E570A96
SHA-256:	FFD96B5393689D272392B87BCB3DA755D06046C01B7E5E68CA4F7775F1C0D0CA
SHA-512:	ACC349E4BDE9BEFC3377E3095F2E7AF9C3E626C3923AB3F99C5A107BBFF5143FBA1E65739FFC34F275CD42D6E1D473E2BFDA9B7A9FDE978070754FBCB0CD3866
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f................G..0................39_config..........6.....n ...1u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.239393085467084
Encrypted:	false
SSDEEP:	6:N7EzfURrRM1wkn23oH+Tcwtfrl2KLlL7EzfUmCXm4q2Pwkn23oH+TcwtfrK+IFUv:N7LFrfYeb1L17fvYfYeb23FUv
MD5:	A1EB4C8E7DCE988EF8CF5C3DB26A49FD
SHA1:	A88BE8F22D0F77FF81ABCD6C7DF413FD415096DB
SHA-256:	CF9D92071F590D05B9D9D9223ED40789EB363BF2FBB3035346E571B8F44E1715
SHA-512:	85DEA04CE8FDC55EC70B84513AA8D227F7EE68B0BF2AFAA463434FE59B1CD9D069AA0F69730038760EE0F2AE62824AD18385A8BFAAE5BA48608C8DB3EE4FE2E1
Malicious:	false
Preview:	2024/08/27-18:04:16.224 2254 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/27-18:04:16.233 2254 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.909061787389665
Encrypted:	false
SSDEEP:	12:G0nYUtTNVrPzl6/5/Xt21tzJ3PEWXZ0+/WuQWQ0:G0nYUtPrPJ6B/XMtzNP9b/ox0
MD5:	F33EDAF16197A4ED2ECE74D4D32CC810
SHA1:	AD688220ED65C8CC3221BDB70E2BD9B4AC4B28CA
SHA-256:	19D8E75ECDA85FB999ED8E997102A26251FC4DC87D7186A79F92EE09DCBB456F
SHA-512:	C2FF15243ADE36CF4B8D5E17A6A9B5BF519611226558631EB0AA1BDFDB0697E620E257F8AE3BCD132040C93DE8A7B58EA2D51D1018DF061D6013FF51F9FDC428
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....s/<..................19_........e.................18_......E...................37_.....`0M..................38_......Hf..................39_.......w<.................20_.........................20_......Y...................18_..........................37_.....W%..................38_.....s...................39_.......1..................19_........I.................21_......j...................21_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.2046937241761
Encrypted:	false
SSDEEP:	6:N7EzfUrRM1wkn23oH+Tcwtfrzs52KLlL7EzfUJo4q2Pwkn23oH+TcwtfrzAdIFUv:N7HrfYebs9L17TXvYfYeb9FUv
MD5:	AD6BD60096FB2312E69AB45A48EC5976
SHA1:	9A9E559084C3E1DA645FD375E92E946B29A0852A
SHA-256:	B175C566B698BBBE8F50208AE6E3F88564A880E9CF493A65A45432B0F156F047
SHA-512:	73BF7C12BB57A32E19C7E21757A967912B5DFB70C1FF96C289653574D7BACC4CBAE0CB2FC8F6B9DFB772259D17D69D70D3AC2D7834826FC5C25E29879C790509
Malicious:	false
Preview:	2024/08/27-18:04:16.169 2254 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/27-18:04:16.206 2254 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNl/a:Ls3
MD5:	58008F025536701BC9E8B04C2F4B6FD6
SHA1:	AA523B277C0B7488E2D14777260D2242EF877C93
SHA-256:	B3311655FE3AF897DA35D5EC244551F311D4DAC372DA77BA2CBFBAA5479C284D
SHA-512:	5564D3894F5024A248F3CCC2106729A8AEF6F032A5F6B9BD2C1FA4B7CC7F2566F64CA6A0AE3595676648BB5FACF898176632FD401B6F48346647591B1359BDC0
Malicious:	false
Preview:	............................................G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlrO8l:Ls3K8l
MD5:	3B9BF4D7B64AE1C8243A1EC31BD17026
SHA1:	068A1AC4B9F67D4EDD5B07E49BFC72E42F52F79E
SHA-256:	26F88013F7EAC84CF4265174D56E37665850A2270127ADFED6475E39876B1944
SHA-512:	992220B8B42BF660E8217C83A7C745BD8296BB56B7B25583A7D528BAA6D5CE1E539B4145273160280274E542E04E213A140E72D9445508805B66899BC29DD3A0
Malicious:	false
Preview:	........................................f...G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d42e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d45d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f2f1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f330.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f33f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f34f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3130c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3132b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF345e4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF345f3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bd65.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e475.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4344b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793492704135714
Encrypted:	false
SSDEEP:	96:iaqkHfgWcnE65ih/cI9URLl8RotoCMFVvlwhme4IbONIeTC6XQS0qGqk+Z4uj+rJ:akIWZTeiRUFhG6qRAq1k8SPxVLZ7VTiq
MD5:	DEE1A7E0E20337FCBF2F3A4D6EBC9B67
SHA1:	374C590F135F690288E2A64F51EBECA8B59A63C8
SHA-256:	3A6EC1DDC8D9B8B14E09050A8C03B47C5C10818D8BB571611F6FFDD28BDAAEA2
SHA-512:	4BDF63C5179C20AA0A2239061C9EDDE1ED06EE7A8E0FE711FBD0106B4521A4F299F20CB5CC1578D2A4817C9D44142983D706E2FC4CECB96AEC875F72400FE50A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAANQrVR/992R57RmqyPHc1kEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACKmQg5+ldPMOMbLg8opMkhx5VsdX0n3bQZ3mY5sDnxfgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2031633
Entropy (8bit):	4.001526192240052
Encrypted:	false
SSDEEP:	49152:qgPh2N/ZR5DgVFmlq6hMA7X4Vxf2H+lz7ASf49JxeqOWlciRayjS09nnwBXQma/G:T
MD5:	BB81EAA289B65556BE360510488F23F8
SHA1:	D326F573D3E622C530DE8C3BA2E24D6623596FC2
SHA-256:	681CFD3B8A2B9EFD673DB8511BD0B041D7B9725869E0B4A213F542F10F900130
SHA-512:	C206CA2DF584B50582AB90D8EAB1B0B4807990403D7FA62B174BE9DB15998A51B45661630A82F7CB70F8FE9F2315255952F1D0A0B0D4A6E86BB97B85E2F168E4
Malicious:	false
Preview:	.........\| .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2031633
Entropy (8bit):	4.001526192240052
Encrypted:	false
SSDEEP:	49152:qgPh2N/ZR5DgVFmlq6hMA7X4Vxf2H+lz7ASf49JxeqOWlciRayjS09nnwBXQma/G:T
MD5:	BB81EAA289B65556BE360510488F23F8
SHA1:	D326F573D3E622C530DE8C3BA2E24D6623596FC2
SHA-256:	681CFD3B8A2B9EFD673DB8511BD0B041D7B9725869E0B4A213F542F10F900130
SHA-512:	C206CA2DF584B50582AB90D8EAB1B0B4807990403D7FA62B174BE9DB15998A51B45661630A82F7CB70F8FE9F2315255952F1D0A0B0D4A6E86BB97B85E2F168E4
Malicious:	false
Preview:	.........\| .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlg:Ls3
MD5:	A02404B5C7D330E73F0193E13BE1D955
SHA1:	0E3E3E314E904B34B94B1A98C5A9411CC42CA2AB
SHA-256:	52B3DCBF0DDF4E2BD63D377442ECCDF5761C1297CA69C1E5D0931A9A32AEDA88
SHA-512:	4FF528C018B0C091A2C496B0B9F51C7491B7637C38E293D2257180BF56A13702ABEE4C233983FD7F84791E009D055340D20C2F19DBFE7BF6342E0B7C8C8B9846
Malicious:	false
Preview:	.........................................e..G./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c54a73aa-a41c-43c8-99e1-bb0e9a96aa8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.8331890391370305
Encrypted:	false
SSDEEP:	192:fsNwIWZreiRUAO1tQ5zyikcr96qRAq1k8SPxVLZ7VTiB:fsNwIUfhm+5Ohcr96q3QxVNZTiB
MD5:	67D5535513622EF904F62D6105B79CEE
SHA1:	689567760338AD9B4B61D56EDEC5C4C54C9116CB
SHA-256:	CE0EACB6373133254A752D32545B5767244E331BAFC4645D96A6EE9B98CC0EE8
SHA-512:	11B3591D53688A9C64B34D40CBEC518D9D43E976FBF69D62661BC75C93E6EA0C77870B982247E65E9454091FA8C86A90CBA24767C21A0D9F560D289B0D4231EE
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ccc0922c-2a83-4a53-87bb-8fc103a8f0bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.058578415546746
Encrypted:	false
SSDEEP:	384:1tM7XKnG7EtlXrjYJUoLUJqHsdZsJHaVsNw5dEUEX8kca00jGX4KX5:fM7X2zt1jKYqHkZeMNdDG8kca034Kp
MD5:	65F7818E038A83381A6F6498C5982F9D
SHA1:	8DA94D8CAA79796C2DB5FD19AEA7CCC4F88A52E8
SHA-256:	340C4397D6D0E07CF1002AEE06F0F3D1E3B543E150668B2234D6BE7ABF4316EE
SHA-512:	3FEAEC3267B2BA1D3935DCB4850A197AD8AB0D24F47C45A7469C9AD1C97704CC88C75C0A7DB205111EFA3824815E1D44BC4F0258C067373754B156890D6C8DE2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369269856170667","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e37b9ccc-5d25-4f40-b457-947c6cd140f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.806786033405353
Encrypted:	false
SSDEEP:	192:fsNAIWZreiRUvBQnkcS6qRAq1k8SPxVLZ7VTiQ:fsNAIUf8ekcS6q3QxVNZTiQ
MD5:	B7CCE8FC3AC4C3076A48FA3D9F64AD34
SHA1:	28D1F5D58AC926788B28E969924D7CEE19CABF95
SHA-256:	20A481595DA1A9C81D9651F9E40FC849307D57CCC6CFFEE1B97D19883EDDCB55
SHA-512:	0B76B98AAE7E3B2908214A9DE5DE8B5271BA4A83DA4E489123A93C2E555960C1EF0B77D459B5A47EA88F8EAED9535A1032FF2454E78B7F7B654FF1C8849833C8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e73dfd13-176b-4ce9-a63e-c060d5c35870.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.800519264756786
Encrypted:	false
SSDEEP:	192:fsNwIWZreiRUABQnkcS6qRAq1k8SPxVLZ7VTiQ:fsNwIUfhekcS6q3QxVNZTiQ
MD5:	E247F71135E22EA20687D011CD2B84E0
SHA1:	1A084A92EB392ED326786524028AA1693958B1BB
SHA-256:	3EE8FA12F6424CD225F44FC08E15CA0473CB5BE2D3F3BDB7157080EA0BBAB6DF
SHA-512:	7E31A5537C7CC27969EA9DE1F9C22AF41E5AFA2F6F3F9818DE9A1042DDD08FD337A7DBDA38A57F1F7B2CD191B44AA5E63E4CBD3DAFCD2207D18B1EB7A121DFC1
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f13326d4-d900-4826-92a6-4776dfb0db5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.833262440819423
Encrypted:	false
SSDEEP:	192:fsNwIWZreiRUAO1tQ5i1Rkcr96qRAq1k8SPxVLZ7VTiB:fsNwIUfhm+5GCcr96q3QxVNZTiB
MD5:	EA4D8A5F66422D814D8302E2188906A6
SHA1:	4C303081E075342EF1534801B76C6604036D69D3
SHA-256:	E21CC9D282F22EF3CCBBEDCDC514F5671867E501D12517E7804221197A7B98FC
SHA-512:	841616E3FF71D38178A0F003A5881D31F2CC561F20823E611D389DC1F9F72CD3E6EFC670D48108FA673AE19A9A7490566461CB0CAA24750BAE952A4FF7572018
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8564471874856623
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxATxl9Il8ud0jNV50a/TmC30H2my8gL5aC93od1rc:mzY70jN70a/CCkWmyX5aCl
MD5:	241628E4B7DBE8B148F84895FD4964F0
SHA1:	C782D67214D8C6B49A7E4E86F7116F6ABF9B35D4
SHA-256:	97C4283E331396D50A826ADC00F383D92829D7197113C5799EE11C015D93C62D
SHA-512:	89359C67211271CB179F5E710D6D536D1F1076CAB812B6468B3F61433DDA9389B712456F10179533F8F98284A1FA3F21EB58EC3711484FB7D83D60429357B59B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.A.a.P.Z.9.X.4.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.D.U.K.1.U.f.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.007083299783488
Encrypted:	false
SSDEEP:	96:8+Y70pmNiw0JeAClrjZtkEX1qa4D0NNL1512XXw:8+jC2ADjA1xwJ5Sw
MD5:	536F84FAA3375070FA739ABD15C68D4C
SHA1:	7D5BB933DCE4B9685CF410CB564C81BD6E318E09
SHA-256:	D60730E059A2644BBB71123E11B9A0C1F1CA19381557BF17D4A9BCE5DA157DB5
SHA-512:	5A052CD9945D20464B7ECD2EFE92E26FCE2D3D7A617998C35CBB9DE4D43B6AA6018D2A9FE06FB1B1FDE8584B72A4C08C5937FFD1F852573C0F5855449B75AE18
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".t.1.b.T.T.c.3.4.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.D.U.K.1.U.f.

C:\Users\user\AppData\Local\Temp\18334183-c485-423f-a502-4e44a9ab7427.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\686389bc-3e91-4442-807e-b9d1b1beea0c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\68aa9556-369c-4206-8118-3a26e2cca08c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\6a009658-b2ca-47bc-b4c4-66a9b28fe877.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.33120657766363
Encrypted:	false
SSDEEP:	12:YEFnQX0Dkv/KFmvYaTL56s/KFm1iy0Dkv/KFmJZ456s/C:YqnE0dmAs5Sm1iy0dmM5M
MD5:	A41FCCB8E26CF0B53833CB078801A017
SHA1:	9A0773211E69F62CF3B350D28953DC3DA138F9B6
SHA-256:	6381AFAEAF7AF8063AC93D0C2E372F948744FEF6F4326C76325611F91BDAE50E
SHA-512:	6AF2B364860D3D5BE7B5ACFE245A23CB3504F106A075FAA511A90F85E6155C49AA0F1CF385FA171D51B01887B3F2365DC60F70102F6EB95225E85A3875555CE0
Malicious:	false
Preview:	{"logTime": "0827/220404", "correlationVector":"0B9D18C9CA6F49699625F12D4C31C1A3","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0827/220418", "correlationVector":"t8VKxxbZ/nrfi13qtAdXXj","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0827/220418", "correlationVector":"582AEF80FF244E7B918ADB68AA626AEE","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0827/220418", "correlationVector":"hozn6PEXnaT/StLG+PD2A0","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\scoped_dir7596_837362730\18334183-c485-423f-a502-4e44a9ab7427.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7596_837362730\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7596_837362730\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7596_837362730\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7596_837362730\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\6a009658-b2ca-47bc-b4c4-66a9b28fe877.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7596_912781120\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5214547394872726
Encrypted:	false
SSDEEP:	48:sIXE9vgkdOwVuxsJs8rAYzBdLXuHIkDpKIX2A2qhdOwluxsJs8rAYzngdLXuHIkz:hBy3uokDUJBynIuokz
MD5:	F7BA5173122644DDCAF96203E21CA1A3
SHA1:	E96AD447B5251431BF5422C8CA5A582E3B9BA939
SHA-256:	E809D9C36784E37B7A2B76E8DA6BF2C12FB779693B56718F8A34418C32756851
SHA-512:	C2FB19FBDE9DA65B48595CCE83890C4D6A549E576221E006831F526B8C4265751AD5984BF244B3B1C9903CAB09EDB5171477B1FDF0FC49A764D2CE8717F66BA0
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....S......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWR`..PROGRA~2.........O.IDWR`....................V......L(.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y..............................A.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y}...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y}.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........6........C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\R9BL2KLFXH851YVJIQJF.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5214547394872726
Encrypted:	false
SSDEEP:	48:sIXE9vgkdOwVuxsJs8rAYzBdLXuHIkDpKIX2A2qhdOwluxsJs8rAYzngdLXuHIkz:hBy3uokDUJBynIuokz
MD5:	F7BA5173122644DDCAF96203E21CA1A3
SHA1:	E96AD447B5251431BF5422C8CA5A582E3B9BA939
SHA-256:	E809D9C36784E37B7A2B76E8DA6BF2C12FB779693B56718F8A34418C32756851
SHA-512:	C2FB19FBDE9DA65B48595CCE83890C4D6A549E576221E006831F526B8C4265751AD5984BF244B3B1C9903CAB09EDB5171477B1FDF0FC49A764D2CE8717F66BA0
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....S......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWR`..PROGRA~2.........O.IDWR`....................V......L(.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y..............................A.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y}...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y}.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........6........C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RVXNAANYQT3N0X1I4VQ5.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5193991726572866
Encrypted:	false
SSDEEP:	48:sIXE2qhdOwluxsJs8rAYzBdLXuHIkDpKIX2A2qhdOwluxsJs8rAYzngdLXuHIk+o:bBy3uokDUJBynIuokz
MD5:	B8F2F5F88BAA45758FAD68558A186A4F
SHA1:	1D234920FA6FF0CEFAD28400D4BFC3BBC2E8E1AA
SHA-256:	F659035AE33862D44C2A549A4AB3886E54EDE3EAB28C8F137BD30B8F0E05CAD7
SHA-512:	FA99759B1CCD40EBF81B2D639701F319529C5730149A3CA70984AD1659F5D5EDD265708C6A134E996A5F3717F280B2CA506FF541F44FF2C06B758156BD94B81D
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....S......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y{...PROGRA~2.........O.I.Y{.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y..............................A.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y.............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y}...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y}.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........6........C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5193991726572866
Encrypted:	false
SSDEEP:	48:sIXE2qhdOwluxsJs8rAYzBdLXuHIkDpKIX2A2qhdOwluxsJs8rAYzngdLXuHIk+o:bBy3uokDUJBynIuokz
MD5:	B8F2F5F88BAA45758FAD68558A186A4F
SHA1:	1D234920FA6FF0CEFAD28400D4BFC3BBC2E8E1AA
SHA-256:	F659035AE33862D44C2A549A4AB3886E54EDE3EAB28C8F137BD30B8F0E05CAD7
SHA-512:	FA99759B1CCD40EBF81B2D639701F319529C5730149A3CA70984AD1659F5D5EDD265708C6A134E996A5F3717F280B2CA506FF541F44FF2C06B758156BD94B81D
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....S......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y{...PROGRA~2.........O.I.Y{.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y..............................A.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y.............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y}...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y}.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........6........C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.579766888123132
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	1d84aa5d8aecd53e1567aadd7df1c13d
SHA1:	ad3162953d9c1d36ef6adca6cccdead69837288e
SHA256:	c96e16b28bb66cb0c704a42586406cada702367b0258eba93739c40f13a17c4b
SHA512:	6151a84e8c2f4eae2e0c5327d43319a54414876043cb3bbff2f38697ca1dc877e81250a40b193de9275617b468b6b804ec1c3ff1c50778c64a17734bdfb589df
SSDEEP:	12288:2qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacT6:2qDEvCTbMWu7rQYlBQcBiT6rprG8as6
TLSH:	EE159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CE4CDD [Tue Aug 27 22:02:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F4DE8C12FD3h
jmp 00007F4DE8C128DFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F4DE8C12ABDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F4DE8C12A8Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F4DE8C1567Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F4DE8C156C8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F4DE8C156B1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	3260fc3338f4533588feecb6cf3620f0	False	0.286953125	data	5.165318932963409	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 00:04:01.727303028 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 28, 2024 00:04:05.120024920 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.120054960 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.120112896 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.120373011 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.120383024 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.179547071 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.179574966 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.179748058 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.179950953 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.179965019 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.772641897 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.780989885 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.781018972 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.782111883 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.782188892 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.783411026 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.783521891 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.783694983 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.783703089 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.849494934 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.863240957 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.884710073 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.884732008 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.884738922 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.884752035 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.884764910 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.884773016 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.884799004 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.884824991 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.884841919 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.884849072 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.884865999 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.884893894 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.884974957 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.884990931 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.886195898 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:05.886253119 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.969515085 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:05.969552040 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:05.969608068 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:05.984833956 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:05.984860897 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:05.984950066 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:05.992077112 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:05.992086887 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:05.992152929 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:05.992455006 CEST	49753	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:05.992461920 CEST	443	49753	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:05.992512941 CEST	49753	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:05.996344090 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:05.996453047 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.000309944 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.000329018 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.004528999 CEST	49753	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.004539013 CEST	443	49753	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.004729033 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.004738092 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.004920006 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.004933119 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.005631924 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.005640984 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.049457073 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.099984884 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.100008965 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.100014925 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.100035906 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.100045919 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.100055933 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.100076914 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.100087881 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.100106001 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.100131989 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.164926052 CEST	49748	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.164951086 CEST	443	49748	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.166327953 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.166353941 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.166420937 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.167875051 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.167881966 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.185646057 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.185672045 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.185718060 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.185729027 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.185749054 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.185769081 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.187036037 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.187051058 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.187112093 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.187118053 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.187215090 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.272012949 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.272034883 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.272078991 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.272087097 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.272118092 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.272140980 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.272341967 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.272391081 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.272394896 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.272422075 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.272497892 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.273211956 CEST	49749	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:06.273221970 CEST	443	49749	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:06.457366943 CEST	443	49753	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.457575083 CEST	49753	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.457585096 CEST	443	49753	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.458581924 CEST	443	49753	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.458642960 CEST	49753	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.460746050 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.465296030 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.465303898 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.466236115 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.466305017 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.466933966 CEST	49753	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.467006922 CEST	443	49753	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.467291117 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.468141079 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.468147993 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.468336105 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.468394995 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.468547106 CEST	49753	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.468556881 CEST	443	49753	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.468750000 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.468756914 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.469249964 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.469305992 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.470164061 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.470231056 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.470494032 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.470499992 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.479835033 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.481996059 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.482008934 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.482878923 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.482945919 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.483798981 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.483856916 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.483942032 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.519085884 CEST	49753	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.528498888 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.534709930 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.534720898 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.550355911 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.550463915 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.576014042 CEST	443	49753	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.576086044 CEST	443	49753	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.576278925 CEST	49753	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.576478958 CEST	49753	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.576495886 CEST	443	49753	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.577117920 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.577191114 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.577234983 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.577387094 CEST	49752	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.577392101 CEST	443	49752	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.581588030 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.594525099 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.594584942 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.594770908 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.594990969 CEST	49750	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.594995975 CEST	443	49750	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.612268925 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.612345934 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.612390995 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.612544060 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:06.612556934 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:06.639235020 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.639616013 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.639622927 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.640657902 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.640731096 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.643277884 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.643340111 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.643599987 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.643604994 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.688828945 CEST	49761	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:06.688859940 CEST	443	49761	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:06.688926935 CEST	49761	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:06.690891027 CEST	49761	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:06.690901041 CEST	443	49761	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:06.723190069 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.723238945 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.723368883 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.723593950 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.723609924 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.781543970 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:06.781606913 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.781852007 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:06.781858921 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:07.184688091 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:07.185199022 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:07.185220003 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:07.185539961 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:07.185837984 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:07.185900927 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:07.185998917 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:07.228508949 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:07.313090086 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:07.313265085 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:07.313599110 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:07.313617945 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:07.334662914 CEST	443	49761	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:07.334729910 CEST	49761	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:07.339742899 CEST	49761	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:07.339751005 CEST	443	49761	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:07.340019941 CEST	443	49761	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:07.390053988 CEST	49761	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:07.432509899 CEST	443	49761	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:07.853744984 CEST	443	49761	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:07.853811979 CEST	443	49761	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:07.854012012 CEST	49761	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:07.854259014 CEST	49761	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:07.854278088 CEST	443	49761	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:07.854302883 CEST	49761	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:07.854309082 CEST	443	49761	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:07.889723063 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:07.889751911 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:07.889950991 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:07.890309095 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:07.890321970 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:08.540697098 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:08.540760994 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:08.570426941 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:08.570447922 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:08.570736885 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:08.572292089 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:08.612503052 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:08.819149017 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:08.819238901 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:08.819298983 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:08.829467058 CEST	49763	443	192.168.2.4	184.28.90.27
Aug 28, 2024 00:04:08.829480886 CEST	443	49763	184.28.90.27	192.168.2.4
Aug 28, 2024 00:04:08.900511026 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:08.900551081 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:08.900612116 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:08.900711060 CEST	49765	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:08.900741100 CEST	443	49765	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:08.900784969 CEST	49765	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:08.900948048 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:08.900959969 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:08.901058912 CEST	49765	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:08.901071072 CEST	443	49765	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.353446960 CEST	443	49765	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.355570078 CEST	49765	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.355587006 CEST	443	49765	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.355933905 CEST	443	49765	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.356396914 CEST	49765	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.356462955 CEST	443	49765	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.381452084 CEST	49766	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.381491899 CEST	443	49766	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.381655931 CEST	49766	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.382004023 CEST	49767	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.382035017 CEST	443	49767	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.382244110 CEST	49767	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.383079052 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.386660099 CEST	49766	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.386660099 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.386673927 CEST	443	49766	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.386674881 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.387109041 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.388653040 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.388829947 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.388849974 CEST	49767	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.388880968 CEST	443	49767	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.406021118 CEST	49765	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.460629940 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.705456018 CEST	49768	443	192.168.2.4	142.250.65.228
Aug 28, 2024 00:04:09.705497026 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:09.705666065 CEST	49768	443	192.168.2.4	142.250.65.228
Aug 28, 2024 00:04:09.705822945 CEST	49768	443	192.168.2.4	142.250.65.228
Aug 28, 2024 00:04:09.705835104 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:09.864990950 CEST	443	49767	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.875226021 CEST	443	49766	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.879368067 CEST	49767	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.879390955 CEST	443	49767	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.879714966 CEST	49766	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.879725933 CEST	443	49766	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.879935980 CEST	443	49767	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.880069017 CEST	49767	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.880110025 CEST	443	49766	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.880259037 CEST	49766	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.880795002 CEST	443	49767	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.880865097 CEST	443	49766	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.880896091 CEST	49767	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.880995035 CEST	49766	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.882479906 CEST	49766	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.882479906 CEST	49767	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.882539034 CEST	443	49766	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.882592916 CEST	443	49767	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.882798910 CEST	49767	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.883126020 CEST	49766	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.883131981 CEST	443	49766	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.928503990 CEST	443	49767	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.933435917 CEST	49767	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.933444977 CEST	443	49767	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:09.962136030 CEST	49766	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:09.993911028 CEST	49767	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.054687023 CEST	443	49767	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.054879904 CEST	443	49767	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.057013035 CEST	49767	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.057027102 CEST	443	49767	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.057055950 CEST	49767	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.057121038 CEST	49767	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.057753086 CEST	443	49766	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.058900118 CEST	49766	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.058936119 CEST	443	49766	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.059055090 CEST	443	49766	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.059091091 CEST	49766	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.059170961 CEST	49766	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.170237064 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:10.170538902 CEST	49768	443	192.168.2.4	142.250.65.228
Aug 28, 2024 00:04:10.170557022 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:10.171613932 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:10.171674967 CEST	49768	443	192.168.2.4	142.250.65.228
Aug 28, 2024 00:04:10.172996044 CEST	49768	443	192.168.2.4	142.250.65.228
Aug 28, 2024 00:04:10.172996044 CEST	49768	443	192.168.2.4	142.250.65.228
Aug 28, 2024 00:04:10.173007011 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:10.173073053 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:10.261096001 CEST	49768	443	192.168.2.4	142.250.65.228
Aug 28, 2024 00:04:10.261111021 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:10.268353939 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:10.268393040 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:10.268420935 CEST	49768	443	192.168.2.4	142.250.65.228
Aug 28, 2024 00:04:10.268429041 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:10.268507957 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:10.268534899 CEST	49768	443	192.168.2.4	142.250.65.228
Aug 28, 2024 00:04:10.268539906 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:10.268568039 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:10.268697977 CEST	49768	443	192.168.2.4	142.250.65.228
Aug 28, 2024 00:04:10.270179987 CEST	49768	443	192.168.2.4	142.250.65.228
Aug 28, 2024 00:04:10.270193100 CEST	443	49768	142.250.65.228	192.168.2.4
Aug 28, 2024 00:04:10.379781008 CEST	49769	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.379797935 CEST	443	49769	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.379964113 CEST	49770	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.379964113 CEST	49769	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.379972935 CEST	443	49770	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.380160093 CEST	49769	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.380172014 CEST	443	49769	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.380177975 CEST	49770	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.380371094 CEST	49770	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.380381107 CEST	443	49770	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.838223934 CEST	443	49770	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.847640038 CEST	49770	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.847652912 CEST	443	49770	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.848054886 CEST	443	49770	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.848109007 CEST	49770	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.848815918 CEST	443	49770	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.848889112 CEST	49770	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.852993011 CEST	49770	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.853065968 CEST	443	49770	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.860327005 CEST	443	49769	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.874305964 CEST	49769	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.874317884 CEST	443	49769	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.874636889 CEST	443	49769	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.874700069 CEST	49769	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.875231981 CEST	443	49769	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.875277042 CEST	49769	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.894675970 CEST	49770	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.894685030 CEST	443	49770	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.937887907 CEST	49769	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.937957048 CEST	443	49769	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.941529036 CEST	49770	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.988404036 CEST	49769	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.988409996 CEST	443	49769	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:11.035281897 CEST	49769	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:14.043844938 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:14.043888092 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:14.043971062 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:14.045068979 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:14.045083046 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:14.771502018 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:14.771598101 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:14.775522947 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:14.775532961 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:14.775774956 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:14.818397999 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:15.557784081 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:15.604497910 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:15.782598019 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:15.782619953 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:15.782628059 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:15.782639980 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:15.782670975 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:15.782716036 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:15.782737970 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:15.782771111 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:15.782882929 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:15.782882929 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:15.782882929 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:15.783082008 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:15.783138037 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:15.783186913 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:16.851561069 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:16.851593018 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:16.851608038 CEST	49771	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:16.851614952 CEST	443	49771	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:18.862634897 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:18.862653971 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:18.862884045 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:18.863142967 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:18.863156080 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.586745977 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.587222099 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.587235928 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.587618113 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.587630033 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.587691069 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.587697983 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.587724924 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.587738991 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.588349104 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.590049982 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.590121031 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.590254068 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.590265989 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.663681984 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:19.663705111 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:19.663758039 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:19.664020061 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:19.664033890 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:19.781791925 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.854703903 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.854749918 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.854809999 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.854820967 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.857624054 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.857683897 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.857692003 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.869412899 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.869468927 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.869477987 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.879483938 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.879565954 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.879575014 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.891309977 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.891371965 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.891381025 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.897923946 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.898011923 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.898020029 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.903345108 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.903399944 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.903409004 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.908260107 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.908344030 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.908353090 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.953845978 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.953891039 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.953910112 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.953926086 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.953969002 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.953974962 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.954627037 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.954687119 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.954693079 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.956525087 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.956578016 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.956585884 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.962599993 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.962678909 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.962687969 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.969106913 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.969372034 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.969381094 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.975032091 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.975097895 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.975111961 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.981343985 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.981440067 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.981446981 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.988219023 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.988270998 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.988279104 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.993976116 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:19.994241953 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:19.994251966 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.000365973 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.000421047 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.000432014 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.008547068 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.008685112 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.008692980 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.012598038 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.012659073 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.012665987 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.018779993 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.018868923 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.018878937 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.038810015 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.038873911 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.038891077 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.041647911 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.041713953 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.041723967 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.045537949 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.045593023 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.045602083 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.049478054 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.049571991 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.049578905 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.052936077 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.052983999 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.052990913 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.056575060 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.056641102 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.056648970 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.060210943 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.060262918 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.060270071 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.063891888 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.063975096 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.063981056 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.067497015 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.067579985 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.067585945 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.071154118 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.071211100 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.071218967 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.074600935 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.074671984 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.074677944 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.078572035 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.078639030 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.078646898 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.081928968 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.081979990 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.081985950 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.085449934 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.085506916 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.085514069 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.088992119 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.089042902 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.089050055 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.092531919 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.092581034 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.092588902 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.096092939 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.096191883 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.096198082 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.099531889 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.099585056 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.099591970 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.102967978 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.103053093 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.103060961 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.106417894 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.106637001 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.106645107 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.109954119 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.110028982 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.110048056 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.113344908 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.113389015 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.113406897 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.116607904 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.116673946 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.116689920 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.120975018 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.121026039 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.121040106 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.123332024 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.123414993 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.123429060 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.127635002 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.127675056 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.127701998 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.127717972 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.127780914 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.130311966 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.132642984 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.132739067 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.132739067 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.132780075 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.133050919 CEST	49783	443	192.168.2.4	142.250.184.193
Aug 28, 2024 00:04:20.133069992 CEST	443	49783	142.250.184.193	192.168.2.4
Aug 28, 2024 00:04:20.310189962 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:20.310507059 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:20.310530901 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:20.311686039 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:20.311748981 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:20.312952995 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:20.313039064 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:20.313405991 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:20.313414097 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:20.379134893 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:20.410371065 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:20.410393953 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:20.410402060 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:20.410418987 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:20.410427094 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:20.410434961 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:20.410442114 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:20.410453081 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:20.410484076 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:20.410501003 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:20.410509109 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:20.410542011 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:20.411755085 CEST	49785	443	192.168.2.4	13.107.246.60
Aug 28, 2024 00:04:20.411771059 CEST	443	49785	13.107.246.60	192.168.2.4
Aug 28, 2024 00:04:22.264663935 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.264693022 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.264765024 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.265408039 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.265429020 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.265492916 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.265749931 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.265763998 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.265957117 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.265975952 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.316138029 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.316155910 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.316265106 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.317337990 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.317352057 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.718949080 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.719337940 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.719364882 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.720396996 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.720494986 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.722153902 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.722249031 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.722393990 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.738442898 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.738930941 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.738940954 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.740240097 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.740319967 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.742556095 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.742625952 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.742760897 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.768496037 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.770353079 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.770967007 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.770987034 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.772042036 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.772118092 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.773307085 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.773386002 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.773562908 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.784502983 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.816508055 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.842768908 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.842834949 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.843153000 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.843168974 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.861912012 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.861985922 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.862257957 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.862268925 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.880120993 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.880139112 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.889187098 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:22.889266968 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.889751911 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:22.889766932 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:24.264704943 CEST	443	49765	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:24.264774084 CEST	443	49765	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:24.264821053 CEST	49765	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:24.289994955 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:24.290064096 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:24.290117025 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:27.231709003 CEST	52735	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:27.236624002 CEST	53	52735	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:27.236690998 CEST	52735	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:27.236730099 CEST	52735	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:27.241626024 CEST	53	52735	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:27.778119087 CEST	53	52735	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:27.779737949 CEST	52735	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:27.782222986 CEST	52736	443	192.168.2.4	152.195.19.97
Aug 28, 2024 00:04:27.782284021 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:27.782864094 CEST	52736	443	192.168.2.4	152.195.19.97
Aug 28, 2024 00:04:27.783191919 CEST	52736	443	192.168.2.4	152.195.19.97
Aug 28, 2024 00:04:27.783204079 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:27.784917116 CEST	53	52735	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:27.784969091 CEST	52735	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:28.358824968 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:28.359289885 CEST	52736	443	192.168.2.4	152.195.19.97
Aug 28, 2024 00:04:28.359316111 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:28.360304117 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:28.360362053 CEST	52736	443	192.168.2.4	152.195.19.97
Aug 28, 2024 00:04:28.361820936 CEST	52736	443	192.168.2.4	152.195.19.97
Aug 28, 2024 00:04:28.361879110 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:28.362148046 CEST	52736	443	192.168.2.4	152.195.19.97
Aug 28, 2024 00:04:28.362154007 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:28.411730051 CEST	52736	443	192.168.2.4	152.195.19.97
Aug 28, 2024 00:04:28.463433981 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:28.464487076 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:28.464497089 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:28.464510918 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:28.464518070 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:28.464545965 CEST	52736	443	192.168.2.4	152.195.19.97
Aug 28, 2024 00:04:28.464562893 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:28.464571953 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:28.464591026 CEST	52736	443	192.168.2.4	152.195.19.97
Aug 28, 2024 00:04:28.464621067 CEST	52736	443	192.168.2.4	152.195.19.97
Aug 28, 2024 00:04:28.465183020 CEST	52736	443	192.168.2.4	152.195.19.97
Aug 28, 2024 00:04:28.465202093 CEST	443	52736	152.195.19.97	192.168.2.4
Aug 28, 2024 00:04:28.728173018 CEST	52737	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:28.728213072 CEST	443	52737	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:28.728334904 CEST	52737	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:28.728657007 CEST	52738	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:28.728663921 CEST	443	52738	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:28.728758097 CEST	52738	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:28.730614901 CEST	52739	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:28.730648994 CEST	443	52739	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:28.730701923 CEST	52739	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:28.730937958 CEST	52740	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:28.730945110 CEST	443	52740	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:28.730992079 CEST	52740	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:28.731133938 CEST	52738	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:28.731146097 CEST	443	52738	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:28.731249094 CEST	52737	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:28.731257915 CEST	443	52737	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:28.731395960 CEST	52739	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:28.731409073 CEST	443	52739	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:28.731554031 CEST	52740	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:28.731561899 CEST	443	52740	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.185317993 CEST	443	52738	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.185566902 CEST	52738	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.185590029 CEST	443	52738	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.185909986 CEST	443	52738	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.186404943 CEST	52738	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.186464071 CEST	443	52738	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.189910889 CEST	443	52740	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.190447092 CEST	52740	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.190454006 CEST	443	52740	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.190774918 CEST	443	52740	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.191288948 CEST	52740	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.191346884 CEST	443	52740	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.191494942 CEST	52740	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.203322887 CEST	443	52739	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.203803062 CEST	52739	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.203825951 CEST	443	52739	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.204051971 CEST	443	52737	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.204142094 CEST	443	52739	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.204725027 CEST	52739	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.204782009 CEST	443	52739	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.204976082 CEST	52737	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.204983950 CEST	443	52737	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.205300093 CEST	443	52737	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.205610037 CEST	52737	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.205663919 CEST	443	52737	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.236501932 CEST	443	52740	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.240111113 CEST	52738	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.257783890 CEST	52737	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.257783890 CEST	52739	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.312925100 CEST	443	52740	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.312997103 CEST	443	52740	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.313076973 CEST	52740	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.313306093 CEST	52740	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.313322067 CEST	443	52740	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:44.096353054 CEST	443	52738	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:44.096421957 CEST	443	52738	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:44.096508026 CEST	52738	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:44.109297991 CEST	443	52737	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:44.109354019 CEST	443	52737	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:44.109395027 CEST	52737	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:44.109893084 CEST	443	52739	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:44.109940052 CEST	443	52739	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:44.110028028 CEST	52739	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:54.548966885 CEST	52743	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:54.549009085 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:54.549082041 CEST	52743	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:54.549534082 CEST	52743	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:54.549550056 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.282015085 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.282075882 CEST	52743	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:55.286010027 CEST	52743	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:55.286022902 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.286227942 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.293653011 CEST	52743	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:55.336509943 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.548150063 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.548171043 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.548182964 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.548333883 CEST	52743	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:55.548350096 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.548402071 CEST	52743	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:55.549381971 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.549421072 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.549443960 CEST	52743	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:55.549451113 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.549463987 CEST	52743	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:55.549474955 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.549519062 CEST	52743	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:55.553234100 CEST	52743	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:55.553246975 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.553271055 CEST	52743	443	192.168.2.4	13.85.23.86
Aug 28, 2024 00:04:55.553276062 CEST	443	52743	13.85.23.86	192.168.2.4
Aug 28, 2024 00:04:55.895380974 CEST	49770	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:55.895392895 CEST	443	49770	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:55.989336014 CEST	49769	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:55.989343882 CEST	443	49769	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:59.945991039 CEST	52744	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:59.946038008 CEST	443	52744	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:59.946154118 CEST	52745	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:59.946192026 CEST	443	52745	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:59.946224928 CEST	52744	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:59.946244955 CEST	52745	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:59.946368933 CEST	52744	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:59.946382999 CEST	443	52744	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:59.946490049 CEST	52745	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:59.946500063 CEST	443	52745	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.403008938 CEST	443	52745	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.403218985 CEST	52745	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.403239965 CEST	443	52745	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.403528929 CEST	443	52745	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.403760910 CEST	52745	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.403835058 CEST	443	52745	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.427665949 CEST	443	52744	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.427886009 CEST	52744	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.427902937 CEST	443	52744	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.428178072 CEST	443	52744	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.428423882 CEST	52744	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.428476095 CEST	443	52744	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.456641912 CEST	52745	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.472537994 CEST	52744	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:09.266577005 CEST	49765	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:09.266618967 CEST	443	49765	172.64.41.3	192.168.2.4
Aug 28, 2024 00:05:09.295891047 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:09.295928001 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 28, 2024 00:05:15.761353970 CEST	443	52744	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:15.761368990 CEST	443	52745	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:15.761431932 CEST	443	52745	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:15.761437893 CEST	443	52744	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:15.761499882 CEST	52745	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:15.762116909 CEST	52744	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:16.820027113 CEST	52739	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:16.820069075 CEST	443	52739	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:29.101176977 CEST	52738	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:29.101208925 CEST	443	52738	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:29.117189884 CEST	52737	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:29.117213011 CEST	443	52737	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:40.910449982 CEST	49770	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:40.910469055 CEST	443	49770	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:41.004324913 CEST	49769	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:41.004344940 CEST	443	49769	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:54.271456957 CEST	49765	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:54.271488905 CEST	443	49765	172.64.41.3	192.168.2.4
Aug 28, 2024 00:05:54.300925970 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:54.300951004 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 28, 2024 00:06:00.769468069 CEST	52744	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:06:00.769474983 CEST	52745	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:06:00.769505978 CEST	443	52744	162.159.61.3	192.168.2.4
Aug 28, 2024 00:06:00.769515991 CEST	443	52745	162.159.61.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 00:04:01.963794947 CEST	53	59318	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:03.182499886 CEST	51399	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:03.182717085 CEST	51672	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:04.529578924 CEST	53	60054	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:04.652616024 CEST	53	59224	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:05.930989981 CEST	57111	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:05.934551001 CEST	59476	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:05.937640905 CEST	53	57111	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:05.941270113 CEST	54777	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:05.941338062 CEST	53	59476	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:05.941659927 CEST	64124	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:05.944941998 CEST	64370	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:05.947954893 CEST	57524	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:05.948445082 CEST	53	64124	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:05.948455095 CEST	53	54777	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:05.951510906 CEST	51440	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:05.951631069 CEST	53	64370	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:05.951659918 CEST	51525	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:05.954546928 CEST	53	57524	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:05.958340883 CEST	53	51440	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:05.958352089 CEST	53	51525	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:06.158370018 CEST	53509	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:06.158602953 CEST	57792	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:06.165059090 CEST	53	53509	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:06.165501118 CEST	53	57792	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:08.597027063 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:08.900087118 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.046356916 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.046454906 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.046466112 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.046479940 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.046492100 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.046796083 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.049052000 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.049206972 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.049547911 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.049757004 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.144458055 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.144495964 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.144505024 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.144512892 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.144794941 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.144906044 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.145926952 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.146658897 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.146884918 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.147514105 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.240067005 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.275197983 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.275320053 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.371771097 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.372368097 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.372626066 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.380675077 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.605784893 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.605873108 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:09.702528000 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.703038931 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.704591036 CEST	443	54732	172.64.41.3	192.168.2.4
Aug 28, 2024 00:04:09.704821110 CEST	54732	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:04:10.057017088 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.379411936 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.517599106 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.517662048 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.519746065 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.523688078 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.523714066 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.523725986 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.523745060 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.523988962 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.525449991 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.525898933 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.526369095 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.527146101 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.527168989 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.527496099 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.620451927 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.620788097 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.621150017 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.622179031 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.622445107 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.622726917 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.699934959 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.700551033 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.702361107 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.703649998 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.705127954 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.706722021 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:10.738571882 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:10.799355030 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:18.011780024 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:18.131031990 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:18.161447048 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:18.214931965 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:18.215786934 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:18.218077898 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:18.248398066 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:18.335500956 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:18.854074001 CEST	65522	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:18.854517937 CEST	64834	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:18.860934973 CEST	53	65522	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:18.862121105 CEST	53	64834	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:19.857460976 CEST	138	138	192.168.2.4	192.168.2.255
Aug 28, 2024 00:04:21.878680944 CEST	53	54170	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:22.255481005 CEST	56310	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:22.255605936 CEST	62930	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:22.256246090 CEST	61792	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:22.256402969 CEST	56772	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:22.262723923 CEST	53	62930	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:22.262739897 CEST	53	56310	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:22.262981892 CEST	53	61792	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:22.263303041 CEST	53	56772	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:22.308559895 CEST	58384	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:22.308773994 CEST	54169	53	192.168.2.4	1.1.1.1
Aug 28, 2024 00:04:22.315339088 CEST	53	54169	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:22.315490961 CEST	53	58384	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:27.231127024 CEST	53	56148	1.1.1.1	192.168.2.4
Aug 28, 2024 00:04:28.727360010 CEST	49713	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:28.730221033 CEST	57471	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.035228014 CEST	49713	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.035795927 CEST	57471	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.174931049 CEST	443	49713	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.175065994 CEST	443	49713	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.175076962 CEST	443	49713	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.175100088 CEST	443	49713	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.175111055 CEST	443	49713	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.175796032 CEST	49713	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.178065062 CEST	49713	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.178618908 CEST	49713	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.178822041 CEST	49713	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.179399014 CEST	49713	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.179567099 CEST	49713	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.189254999 CEST	443	57471	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.189512014 CEST	443	57471	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.189718008 CEST	443	57471	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.189785004 CEST	443	57471	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.189796925 CEST	443	57471	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.190077066 CEST	57471	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.191493034 CEST	57471	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.192142963 CEST	57471	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.192398071 CEST	57471	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.192821026 CEST	57471	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.273991108 CEST	443	49713	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.274003983 CEST	443	49713	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.274012089 CEST	443	49713	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.274019957 CEST	443	49713	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.275361061 CEST	443	49713	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.276345015 CEST	443	49713	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.276470900 CEST	443	49713	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.279165030 CEST	49713	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.279248953 CEST	49713	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.279567003 CEST	49713	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.285520077 CEST	443	57471	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.285535097 CEST	443	57471	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.285810947 CEST	443	57471	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.285870075 CEST	443	57471	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.286812067 CEST	443	57471	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.287705898 CEST	443	57471	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.287942886 CEST	57471	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.288039923 CEST	57471	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.314057112 CEST	57471	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.378091097 CEST	443	49713	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.383012056 CEST	443	57471	162.159.61.3	192.168.2.4
Aug 28, 2024 00:04:29.413475990 CEST	49713	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:29.413528919 CEST	57471	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:04:39.398494959 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:39.398562908 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:39.496182919 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:39.525415897 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:39.574122906 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:39.574559927 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:39.617459059 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:39.617511988 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:39.722500086 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:39.758276939 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:39.788297892 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:39.812443972 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:39.813518047 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:39.813597918 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:39.855046988 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:39.932531118 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:43.522512913 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:43.522563934 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:43.740509987 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:43.758678913 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:43.787463903 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:43.830261946 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:43.830585957 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:04:43.846344948 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:43.924441099 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:04:59.945825100 CEST	52754	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.253879070 CEST	52754	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.401959896 CEST	443	52754	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.401998997 CEST	443	52754	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.402009964 CEST	443	52754	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.402054071 CEST	443	52754	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.402065039 CEST	443	52754	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.402477026 CEST	52754	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.403927088 CEST	52754	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.404216051 CEST	52754	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.404318094 CEST	52754	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.404614925 CEST	52754	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.404742002 CEST	52754	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.499620914 CEST	443	52754	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.499638081 CEST	443	52754	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.499644995 CEST	443	52754	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.499651909 CEST	443	52754	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.500009060 CEST	52754	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.500081062 CEST	52754	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.501071930 CEST	443	52754	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.502964973 CEST	443	52754	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.503005981 CEST	443	52754	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.503211975 CEST	52754	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:00.595753908 CEST	443	52754	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:00.628603935 CEST	52754	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:10.522509098 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:10.620106936 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:10.649327993 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:10.702498913 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:10.702867985 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:10.704619884 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:10.738928080 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:10.827430964 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:11.021096945 CEST	58503	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:11.021286964 CEST	58503	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:11.021867990 CEST	58503	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:11.022371054 CEST	58503	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:11.394180059 CEST	58503	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:11.465859890 CEST	443	58503	172.64.41.3	192.168.2.4
Aug 28, 2024 00:05:11.466368914 CEST	58503	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:11.489165068 CEST	443	58503	172.64.41.3	192.168.2.4
Aug 28, 2024 00:05:11.489196062 CEST	443	58503	172.64.41.3	192.168.2.4
Aug 28, 2024 00:05:11.489206076 CEST	443	58503	172.64.41.3	192.168.2.4
Aug 28, 2024 00:05:11.489212990 CEST	443	58503	172.64.41.3	192.168.2.4
Aug 28, 2024 00:05:11.505275011 CEST	58503	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:11.505367994 CEST	58503	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:11.505438089 CEST	58503	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:11.560256004 CEST	443	58503	172.64.41.3	192.168.2.4
Aug 28, 2024 00:05:11.597726107 CEST	58503	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:11.600058079 CEST	443	58503	172.64.41.3	192.168.2.4
Aug 28, 2024 00:05:11.600279093 CEST	58503	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:11.697063923 CEST	443	58503	172.64.41.3	192.168.2.4
Aug 28, 2024 00:05:11.697468996 CEST	443	58503	172.64.41.3	192.168.2.4
Aug 28, 2024 00:05:11.697762966 CEST	443	58503	172.64.41.3	192.168.2.4
Aug 28, 2024 00:05:11.698437929 CEST	58503	443	192.168.2.4	172.64.41.3
Aug 28, 2024 00:05:11.699143887 CEST	58989	443	192.168.2.4	172.253.63.84
Aug 28, 2024 00:05:11.699285984 CEST	58989	443	192.168.2.4	172.253.63.84
Aug 28, 2024 00:05:12.146975994 CEST	443	58989	172.253.63.84	192.168.2.4
Aug 28, 2024 00:05:12.147002935 CEST	443	58989	172.253.63.84	192.168.2.4
Aug 28, 2024 00:05:12.147017002 CEST	443	58989	172.253.63.84	192.168.2.4
Aug 28, 2024 00:05:12.147548914 CEST	443	58989	172.253.63.84	192.168.2.4
Aug 28, 2024 00:05:12.147715092 CEST	58989	443	192.168.2.4	172.253.63.84
Aug 28, 2024 00:05:12.159751892 CEST	58989	443	192.168.2.4	172.253.63.84
Aug 28, 2024 00:05:12.246582985 CEST	443	58989	172.253.63.84	192.168.2.4
Aug 28, 2024 00:05:12.247641087 CEST	58989	443	192.168.2.4	172.253.63.84
Aug 28, 2024 00:05:12.247967958 CEST	58989	443	192.168.2.4	172.253.63.84
Aug 28, 2024 00:05:12.347455978 CEST	443	58989	172.253.63.84	192.168.2.4
Aug 28, 2024 00:05:12.347472906 CEST	443	58989	172.253.63.84	192.168.2.4
Aug 28, 2024 00:05:12.347481966 CEST	443	58989	172.253.63.84	192.168.2.4
Aug 28, 2024 00:05:12.347814083 CEST	58989	443	192.168.2.4	172.253.63.84
Aug 28, 2024 00:05:12.347965002 CEST	58989	443	192.168.2.4	172.253.63.84
Aug 28, 2024 00:05:12.378488064 CEST	58989	443	192.168.2.4	172.253.63.84
Aug 28, 2024 00:05:12.385961056 CEST	443	58989	172.253.63.84	192.168.2.4
Aug 28, 2024 00:05:12.386094093 CEST	443	58989	172.253.63.84	192.168.2.4
Aug 28, 2024 00:05:12.386370897 CEST	58989	443	192.168.2.4	172.253.63.84
Aug 28, 2024 00:05:12.425321102 CEST	58989	443	192.168.2.4	172.253.63.84
Aug 28, 2024 00:05:12.510153055 CEST	443	58989	172.253.63.84	192.168.2.4
Aug 28, 2024 00:05:13.678926945 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:13.910418034 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:14.274805069 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:14.342413902 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:14.352018118 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:14.354088068 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:14.354089022 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:14.395768881 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:14.472856998 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:34.883780956 CEST	55213	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:34.883971930 CEST	55213	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:34.884207010 CEST	55213	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:34.884295940 CEST	55213	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:35.300638914 CEST	55213	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:35.481363058 CEST	443	55213	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:35.481381893 CEST	443	55213	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:35.481391907 CEST	443	55213	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:35.481403112 CEST	443	55213	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:35.481412888 CEST	443	55213	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:35.482058048 CEST	55213	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:35.482152939 CEST	55213	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:35.482234955 CEST	55213	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:35.482305050 CEST	55213	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:35.576030970 CEST	443	55213	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:35.576049089 CEST	443	55213	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:35.578634024 CEST	55213	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:35.674407959 CEST	443	55213	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:35.675259113 CEST	443	55213	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:35.675673962 CEST	443	55213	162.159.61.3	192.168.2.4
Aug 28, 2024 00:05:35.700331926 CEST	55213	443	192.168.2.4	162.159.61.3
Aug 28, 2024 00:05:41.040602922 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:41.040668964 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:41.138756037 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:41.176306963 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:41.214739084 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:41.215269089 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:41.217298985 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:41.254256964 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:41.340854883 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:44.649199963 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:44.649246931 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:44.743810892 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:44.770612001 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:44.821732998 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:44.822205067 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:44.823432922 CEST	443	59950	142.251.40.110	192.168.2.4
Aug 28, 2024 00:05:44.863528967 CEST	59950	443	192.168.2.4	142.251.40.110
Aug 28, 2024 00:05:44.941487074 CEST	443	59950	142.251.40.110	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 28, 2024 00:04:03.182499886 CEST	192.168.2.4	1.1.1.1	0xf61a	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:03.182717085 CEST	192.168.2.4	1.1.1.1	0xa8ae	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Aug 28, 2024 00:04:05.930989981 CEST	192.168.2.4	1.1.1.1	0x6972	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:05.934551001 CEST	192.168.2.4	1.1.1.1	0x50bb	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 00:04:05.941270113 CEST	192.168.2.4	1.1.1.1	0x208b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:05.941659927 CEST	192.168.2.4	1.1.1.1	0x98a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 00:04:05.944941998 CEST	192.168.2.4	1.1.1.1	0x4ec0	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:05.947954893 CEST	192.168.2.4	1.1.1.1	0x5b1e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 00:04:05.951510906 CEST	192.168.2.4	1.1.1.1	0xa04d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:05.951659918 CEST	192.168.2.4	1.1.1.1	0xbc73	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 00:04:06.158370018 CEST	192.168.2.4	1.1.1.1	0x3b26	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:06.158602953 CEST	192.168.2.4	1.1.1.1	0x9499	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 00:04:18.854074001 CEST	192.168.2.4	1.1.1.1	0x3698	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:18.854517937 CEST	192.168.2.4	1.1.1.1	0x9a90	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Aug 28, 2024 00:04:22.255481005 CEST	192.168.2.4	1.1.1.1	0xc550	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:22.255605936 CEST	192.168.2.4	1.1.1.1	0x96a3	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 00:04:22.256246090 CEST	192.168.2.4	1.1.1.1	0xf17e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:22.256402969 CEST	192.168.2.4	1.1.1.1	0xee1d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 00:04:22.308559895 CEST	192.168.2.4	1.1.1.1	0x7ca7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:22.308773994 CEST	192.168.2.4	1.1.1.1	0xbc69	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 28, 2024 00:04:03.189899921 CEST	1.1.1.1	192.168.2.4	0xf61a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:03.190874100 CEST	1.1.1.1	192.168.2.4	0xa8ae	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:05.118633986 CEST	1.1.1.1	192.168.2.4	0x20ff	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:05.118633986 CEST	1.1.1.1	192.168.2.4	0x20ff	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:05.937640905 CEST	1.1.1.1	192.168.2.4	0x6972	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:05.937640905 CEST	1.1.1.1	192.168.2.4	0x6972	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:05.941338062 CEST	1.1.1.1	192.168.2.4	0x50bb	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 00:04:05.948445082 CEST	1.1.1.1	192.168.2.4	0x98a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 00:04:05.948455095 CEST	1.1.1.1	192.168.2.4	0x208b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:05.948455095 CEST	1.1.1.1	192.168.2.4	0x208b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:05.951631069 CEST	1.1.1.1	192.168.2.4	0x4ec0	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:05.951631069 CEST	1.1.1.1	192.168.2.4	0x4ec0	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:05.954546928 CEST	1.1.1.1	192.168.2.4	0x5b1e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 00:04:05.958340883 CEST	1.1.1.1	192.168.2.4	0xa04d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:05.958340883 CEST	1.1.1.1	192.168.2.4	0xa04d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:05.958352089 CEST	1.1.1.1	192.168.2.4	0xbc73	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 00:04:06.165059090 CEST	1.1.1.1	192.168.2.4	0x3b26	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:06.165059090 CEST	1.1.1.1	192.168.2.4	0x3b26	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:06.165501118 CEST	1.1.1.1	192.168.2.4	0x9499	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 00:04:18.860934973 CEST	1.1.1.1	192.168.2.4	0x3698	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:18.860934973 CEST	1.1.1.1	192.168.2.4	0x3698	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.193	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:18.862121105 CEST	1.1.1.1	192.168.2.4	0x9a90	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:19.661262035 CEST	1.1.1.1	192.168.2.4	0xe0f8	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:19.661262035 CEST	1.1.1.1	192.168.2.4	0xe0f8	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:20.154450893 CEST	1.1.1.1	192.168.2.4	0x283	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:20.154450893 CEST	1.1.1.1	192.168.2.4	0x283	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:20.174278975 CEST	1.1.1.1	192.168.2.4	0x8581	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:21.171694994 CEST	1.1.1.1	192.168.2.4	0x61de	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:21.171694994 CEST	1.1.1.1	192.168.2.4	0x61de	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:21.172044039 CEST	1.1.1.1	192.168.2.4	0xf0a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:22.262723923 CEST	1.1.1.1	192.168.2.4	0x96a3	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 00:04:22.262739897 CEST	1.1.1.1	192.168.2.4	0xc550	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:22.262739897 CEST	1.1.1.1	192.168.2.4	0xc550	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:22.262981892 CEST	1.1.1.1	192.168.2.4	0xf17e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:22.262981892 CEST	1.1.1.1	192.168.2.4	0xf17e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:22.263303041 CEST	1.1.1.1	192.168.2.4	0xee1d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 00:04:22.315339088 CEST	1.1.1.1	192.168.2.4	0xbc69	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 00:04:22.315490961 CEST	1.1.1.1	192.168.2.4	0x7ca7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:22.315490961 CEST	1.1.1.1	192.168.2.4	0x7ca7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:23.205200911 CEST	1.1.1.1	192.168.2.4	0x871a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:23.205200911 CEST	1.1.1.1	192.168.2.4	0x871a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:24.213810921 CEST	1.1.1.1	192.168.2.4	0x871a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:24.213810921 CEST	1.1.1.1	192.168.2.4	0x871a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:25.216577053 CEST	1.1.1.1	192.168.2.4	0x871a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:25.216577053 CEST	1.1.1.1	192.168.2.4	0x871a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:04:27.778119087 CEST	1.1.1.1	192.168.2.4	0x1	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:04:27.778119087 CEST	1.1.1.1	192.168.2.4	0x1	No error (0)	sni1gl.wpc.nucdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:05:14.186686039 CEST	1.1.1.1	192.168.2.4	0xf866	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:05:14.186686039 CEST	1.1.1.1	192.168.2.4	0xf866	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:05:14.417443991 CEST	1.1.1.1	192.168.2.4	0xf866	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:05:14.417443991 CEST	1.1.1.1	192.168.2.4	0xf866	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:05:15.768260002 CEST	1.1.1.1	192.168.2.4	0xf866	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:05:15.768260002 CEST	1.1.1.1	192.168.2.4	0xf866	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:05:17.432580948 CEST	1.1.1.1	192.168.2.4	0xf866	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:05:17.432580948 CEST	1.1.1.1	192.168.2.4	0xf866	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 00:05:21.436804056 CEST	1.1.1.1	192.168.2.4	0xf866	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 00:05:21.436804056 CEST	1.1.1.1	192.168.2.4	0xf866	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

slscr.update.microsoft.com

clients2.googleusercontent.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49748	13.107.246.60	443	8096	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:05 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-27 22:04:05 UTC	559	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 22:04:05 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 95d786f7-901e-0026-728f-f8f3b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240827T220405Z-15c77d89844n6dtp5f09y9f4c80000000kx000000000ct4c Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-27 22:04:05 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49749	13.107.246.60	443	8096	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:05 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-27 22:04:06 UTC	583	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 22:04:06 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 14c701d7-e01e-0029-02e8-f61e45000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240827T220406Z-15c77d89844fm6cd7bzmz9fe9g0000000k3g00000000gtcr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-27 22:04:06 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-08-27 22:04:06 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-08-27 22:04:06 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-08-27 22:04:06 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-08-27 22:04:06 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49753	172.64.41.3	443	8096	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-27 22:04:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-27 22:04:06 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 27 Aug 2024 22:04:06 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8b9f5afcd8121791-EWR alt-svc: h3=":443"; ma=86400
2024-08-27 22:04:06 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 10 00 04 8e fa 40 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49752	162.159.61.3	443	8096	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-27 22:04:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-27 22:04:06 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 27 Aug 2024 22:04:06 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8b9f5afcdb09c3f0-EWR alt-svc: h3=":443"; ma=86400
2024-08-27 22:04:06 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 88 00 04 8e fa 40 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49750	172.64.41.3	443	8096	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-27 22:04:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-27 22:04:06 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 27 Aug 2024 22:04:06 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8b9f5afce94b7c94-EWR alt-svc: h3=":443"; ma=86400
2024-08-27 22:04:06 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 19 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49751	172.64.41.3	443	8096	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-27 22:04:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-27 22:04:06 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 27 Aug 2024 22:04:06 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8b9f5afd0aaa43c3-EWR alt-svc: h3=":443"; ma=86400
2024-08-27 22:04:06 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 5d 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom]Hc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49755	162.159.61.3	443	8096	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-27 22:04:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-27 22:04:06 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 27 Aug 2024 22:04:06 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8b9f5afe1a41422e-EWR alt-svc: h3=":443"; ma=86400
2024-08-27 22:04:06 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 15 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49762	162.159.61.3	443	8096	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:07 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-27 22:04:07 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-27 22:04:07 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 27 Aug 2024 22:04:07 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8b9f5b0169a1c333-EWR alt-svc: h3=":443"; ma=86400
2024-08-27 22:04:07 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 eb 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49761	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:07 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-27 22:04:07 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF17) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=63379 Date: Tue, 27 Aug 2024 22:04:07 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49763	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:08 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-27 22:04:08 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=67292 Date: Tue, 27 Aug 2024 22:04:08 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-27 22:04:08 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49767	142.251.40.110	443	8096	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:09 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-27 22:04:10 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Tue, 27 Aug 2024 22:04:09 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49766	142.251.40.110	443	8096	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:09 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-27 22:04:10 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Tue, 27 Aug 2024 22:04:09 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49768	142.250.65.228	443	8096	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:10 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-27 22:04:10 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 27 Aug 2024 21:10:31 GMT Expires: Wed, 04 Sep 2024 21:10:31 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 3219 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-27 22:04:10 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-08-27 22:04:10 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-08-27 22:04:10 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-08-27 22:04:10 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-08-27 22:04:10 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49771	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=e1nCET6+FHWRer1&MD=bT15VvgP HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-27 22:04:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c3c4ad65-4c7d-42ba-afcb-2176c3a6f8c0 MS-RequestId: ffef8cb9-ffac-47fa-9adb-c5e90fb05c58 MS-CV: BCshIcdbO0mlsMG6.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 27 Aug 2024 22:04:14 GMT Connection: close Content-Length: 24490
2024-08-27 22:04:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-27 22:04:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49783	142.250.184.193	443	9140	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:19 UTC	594	OUT	GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-27 22:04:19 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AHxI1nOuKekGWvHppB2Ipaza0yyHOuZwGHGszbP2J16xrdsKhk6H0EWy_t7Bgliz8YMFH_JtluZrqgrHeg X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Tue, 27 Aug 2024 14:27:46 GMT Expires: Wed, 27 Aug 2025 14:27:46 GMT Cache-Control: public, max-age=31536000 Age: 27393 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-27 22:04:19 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-08-27 22:04:19 UTC	1390	IN	Data Raw: fd c7 0f 59 dd ca cf cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d Data Ascii: Y0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>
2024-08-27 22:04:19 UTC	1390	IN	Data Raw: b0 78 c3 9a 50 64 5d fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad Data Ascii: xPd]DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewW
2024-08-27 22:04:19 UTC	1390	IN	Data Raw: d9 73 4a e4 91 70 9d a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d Data Ascii: sJp:fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~
2024-08-27 22:04:19 UTC	1390	IN	Data Raw: 58 f0 77 67 86 f4 73 f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb Data Ascii: Xwgs9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:
2024-08-27 22:04:19 UTC	1390	IN	Data Raw: 4d 15 00 a4 81 86 68 ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a Data Ascii: Mh3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:
2024-08-27 22:04:19 UTC	1390	IN	Data Raw: a0 8e 2c ba 65 e8 66 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 Data Ascii: ,ef4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$
2024-08-27 22:04:19 UTC	1390	IN	Data Raw: 3f ec fa 62 d7 ae 70 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 Data Ascii: ?bpnh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u
2024-08-27 22:04:19 UTC	1390	IN	Data Raw: f9 d6 22 50 e1 7c 45 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 Data Ascii: "P\|E'3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9
2024-08-27 22:04:19 UTC	1390	IN	Data Raw: 4e 57 c1 ef e1 60 9a 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f Data Ascii: NW`^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gOD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49785	13.107.246.60	443	9140	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:20 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-27 22:04:20 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 22:04:20 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 95d786f7-901e-0026-728f-f8f3b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240827T220420Z-15c77d89844x4cv6tct3vbzssn0000000h7g000000001b9v Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-27 22:04:20 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49787	162.159.61.3	443	9140	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:22 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-27 22:04:22 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-27 22:04:22 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 27 Aug 2024 22:04:22 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8b9f5b627ab041c0-EWR alt-svc: h3=":443"; ma=86400
2024-08-27 22:04:22 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 04 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49788	162.159.61.3	443	9140	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:22 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-27 22:04:22 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-27 22:04:22 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 27 Aug 2024 22:04:22 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8b9f5b629d377ca5-EWR alt-svc: h3=":443"; ma=86400
2024-08-27 22:04:22 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e1 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49789	162.159.61.3	443	9140	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:22 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-27 22:04:22 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-27 22:04:22 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 27 Aug 2024 22:04:22 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8b9f5b62cf3dc431-EWR alt-svc: h3=":443"; ma=86400
2024-08-27 22:04:22 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c3 00 04 8e fa 40 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	52736	152.195.19.97	443	9140	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:28 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725401059&P2=404&P3=2&P4=MxlQetuhUPn2VzEHyWRBdPw7qKVTSjO5MfGcFoXX13moZYVvVEDshPcTi2HhKix7UY3xZN%2bt%2fR54Qv9qr6P19g%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: hozn6PEXnaT/StLG+PD2A0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-27 22:04:28 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4722799 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Tue, 27 Aug 2024 22:04:28 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-08-27 22:04:28 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	52740	162.159.61.3	443	9140	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-27 22:04:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-08-27 22:04:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 27 Aug 2024 22:04:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8b9f5b8aeb3d42da-EWR alt-svc: h3=":443"; ma=86400
2024-08-27 22:04:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d e3 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 0f 00 02 c0 43 c0 43 00 01 00 01 00 00 00 0f 00 04 0d 6b 15 ef c0 43 00 01 00 01 00 00 00 0f 00 04 cc 4f c5 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0CCkCO)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	52743	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-08-27 22:04:55 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=e1nCET6+FHWRer1&MD=bT15VvgP HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-27 22:04:55 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 3858fdba-f300-4f8e-aa4a-45282447d6e5 MS-RequestId: f1f2d49e-fa5e-4d35-bd2c-5d4bf4ca7367 MS-CV: M+Fl0IIBaEif8fRA.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 27 Aug 2024 22:04:55 GMT Connection: close Content-Length: 30005
2024-08-27 22:04:55 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-27 22:04:55 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	18:03:57
Start date:	27/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xcc0000
File size:	917'504 bytes
MD5 hash:	1D84AA5D8AECD53E1567AADD7DF1C13D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	18:03:57
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:03:58
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2092,i,8600603416719304187,13124135000556718685,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:03:58
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	18:03:58
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2780 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	18:04:03
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3440 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:04:03
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6624 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:04:03
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff7e22c0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:04:03
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=2444,i,15106179186340198092,18056790995560820351,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff7e22c0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	18:04:15
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	18:04:16
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	18:04:16
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4504 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:04:18
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:8
Imagebase:	0x7ff7e22c0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:04:18
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=2152,i,8161986127320699430,8322300081516915914,262144 /prefetch:8
Imagebase:	0x7ff7e22c0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:04:23
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	18:04:24
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2080,i,12276315418362096745,837987365199203899,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	18:04:31
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:04:32
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2060,i,2702299294665061934,3123755866690733270,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	18:04:45
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	18:04:45
Start date:	27/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2052,i,11272247715106143866,5476800878713775811,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	1429
Total number of Limit Nodes:	48

Executed Functions

Function 00CC42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00CC430D

Part of subcall function 00CC6B57: _wcslen.LIBCMT ref: 00CC6B6A

GetCurrentProcess.KERNEL32(?,00D5CB64,00000000,?,?), ref: 00CC4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00CC4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00CC4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00CC4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00CC4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00CC447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00CC44A0

Strings

GetNativeSystemInfo, xrefs: 00CC4460
kernel32.dll, xrefs: 00CC444F
|O, xrefs: 00D036F8

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 856a0f4dc61c294412ac6d55a1546622fe5086d912b6998f6c6cd048ef94e511
Instruction ID: ccf6f4b304b620ecd77eb27ac9fbe8f342ce89cc21d49e0b81143b93ca240ed2
Opcode Fuzzy Hash: 856a0f4dc61c294412ac6d55a1546622fe5086d912b6998f6c6cd048ef94e511
Instruction Fuzzy Hash: DDA1D56D91A3C2DFCB1ADB79BC417A53FF86B26300B18999FD845D3B61D2214608DB31

Function 00CC42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00CC50AA,?,?,00000000,00000000), ref: 00CC42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00CC50AA,?,?,00000000,00000000), ref: 00CC42C9
LoadResource.KERNEL32(?,00000000,?,?,00CC50AA,?,?,00000000,00000000,?,?,?,?,?,?,00CC4F20), ref: 00D035BE
SizeofResource.KERNEL32(?,00000000,?,?,00CC50AA,?,?,00000000,00000000,?,?,?,?,?,?,00CC4F20), ref: 00D035D3
LockResource.KERNEL32(00CC50AA,?,?,00CC50AA,?,?,00000000,00000000,?,?,?,?,?,?,00CC4F20,?), ref: 00D035E6

Strings

SCRIPT, xrefs: 00CC42BF

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: cb43b423f0346572c2fbd9b4bb8ec4730b4c75cb9e043adbc598d41092b7a5f1
Instruction ID: 32133e24374035ee1a363d97c9454aaaa12af92e7e92daa1635ac35cfb65271f
Opcode Fuzzy Hash: cb43b423f0346572c2fbd9b4bb8ec4730b4c75cb9e043adbc598d41092b7a5f1
Instruction Fuzzy Hash: 38117C70200700BFDB258B65DC49F277BB9EBC5B52F2481ADF816DA2A0DB71D800D630

Function 00D02BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00CC2B6B

Part of subcall function 00CC3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00D91418,?,00CC2E7F,?,?,?,00000000), ref: 00CC3A78

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00D82224), ref: 00D02C10
ShellExecuteW.SHELL32(00000000,?,?,00D82224), ref: 00D02C17

Strings

runas, xrefs: 00D02C0B

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 3340ac45afe15c32730dfeca96051442d95d04a48c7c642a638c7106e5c961a3
Instruction ID: 2380782417508870fc36a673799cf19d7b957da20466f80d98bcc2184d05097b
Opcode Fuzzy Hash: 3340ac45afe15c32730dfeca96051442d95d04a48c7c642a638c7106e5c961a3
Instruction Fuzzy Hash: 9411B4316083866EC714FF60E855F7EB7A49B95300F48542DF092521A2CF308A4AA722

Function 00D2DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00D05222), ref: 00D2DBCE
GetFileAttributesW.KERNELBASE(?), ref: 00D2DBDD
FindFirstFileW.KERNEL32(?,?), ref: 00D2DBEE
FindClose.KERNEL32(00000000), ref: 00D2DBFA

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 6aeb9cdb804d169566f996ec8ac534eb1774e3686dd4e9685d8aae149595bb5c
Instruction ID: 441317bdbb4c7ef64b8c04a979eadf2df0a91e50aa17c65d669cfcb2ec94862d
Opcode Fuzzy Hash: 6aeb9cdb804d169566f996ec8ac534eb1774e3686dd4e9685d8aae149595bb5c
Instruction Fuzzy Hash: 5BF0A030820B205B82206B78AC0D8AA377D9E1533BB144702F876D22E0EBB09954D6BA

Function 00D4AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00D4B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00D4B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00D4B1D4
_wcslen.LIBCMT ref: 00D4B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00D4B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00D4B236
_wcslen.LIBCMT ref: 00D4B332

Part of subcall function 00D305A7: GetStdHandle.KERNEL32(000000F6), ref: 00D305C6

_wcslen.LIBCMT ref: 00D4B34B
_wcslen.LIBCMT ref: 00D4B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00D4B3B6
GetLastError.KERNEL32(00000000), ref: 00D4B407
CloseHandle.KERNEL32(?), ref: 00D4B439
CloseHandle.KERNEL32(00000000), ref: 00D4B44A
CloseHandle.KERNEL32(00000000), ref: 00D4B45C
CloseHandle.KERNEL32(00000000), ref: 00D4B46E
CloseHandle.KERNEL32(?), ref: 00D4B4E3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 81781119e769b46eee37bfbba11a15605d3618917bfd181e35702b77818cd3dd
Instruction ID: b4fdf8d247069799ac2902fcb30cb08d4c1136d2ddbc0d8e7309d6db4b49966d
Opcode Fuzzy Hash: 81781119e769b46eee37bfbba11a15605d3618917bfd181e35702b77818cd3dd
Instruction Fuzzy Hash: BEF1AE315083409FC714EF24C891B6EBBE5EF95324F18855EF8999B2A2CB31EC45DB62

Function 00CCD730 Relevance: 21.6, APIs: 14, Instructions: 625windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00CCD807
timeGetTime.WINMM ref: 00CCDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00CCDB28
TranslateMessage.USER32(?), ref: 00CCDB7B
DispatchMessageW.USER32(?), ref: 00CCDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00CCDB9F
Sleep.KERNELBASE(0000000A), ref: 00CCDBB1

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 9a634a40a4e8882a54fb1b4cc7a4e4f6646af471a0c018044a47c14707ece515
Instruction ID: bae02f79fbbde5a8674417b1dc521030f6658c083b7beb5ac751ed3e72dd743f
Opcode Fuzzy Hash: 9a634a40a4e8882a54fb1b4cc7a4e4f6646af471a0c018044a47c14707ece515
Instruction Fuzzy Hash: 7342F130608341AFD728CF24D894FBAB7E1BF45300F18452EE5A687391DB71E994DBA2

Function 00CC2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00CC2D07
RegisterClassExW.USER32(00000030), ref: 00CC2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00CC2D42
InitCommonControlsEx.COMCTL32(?), ref: 00CC2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00CC2D6F
LoadIconW.USER32(000000A9), ref: 00CC2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00CC2D94

Strings

TaskbarCreated, xrefs: 00CC2D37
0, xrefs: 00CC2CE9
+, xrefs: 00CC2CF0
AutoIt v3 GUI, xrefs: 00CC2D23

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: c6628ebd3bf14e2ad82a9dcea7862a05f8362a72b28fac761eed7be09956c3a5
Instruction ID: 45dc236b256e5df77d26f8bff3941e178040ba912a187cac296951e1a6c58721
Opcode Fuzzy Hash: c6628ebd3bf14e2ad82a9dcea7862a05f8362a72b28fac761eed7be09956c3a5
Instruction Fuzzy Hash: 6421B2B9911319AFDB00DFA4EC49B9DBBB4FB08702F10511AE921E63A0D7B15544CFA1

Function 00D0065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D0039A: CreateFileW.KERNELBASE(00000000,00000000,?,00D00704,?,?,00000000,?,00D00704,00000000,0000000C), ref: 00D003B7

GetLastError.KERNEL32 ref: 00D0076F
__dosmaperr.LIBCMT ref: 00D00776
GetFileType.KERNELBASE(00000000), ref: 00D00782
GetLastError.KERNEL32 ref: 00D0078C
__dosmaperr.LIBCMT ref: 00D00795
CloseHandle.KERNEL32(00000000), ref: 00D007B5
CloseHandle.KERNEL32(?), ref: 00D008FF
GetLastError.KERNEL32 ref: 00D00931
__dosmaperr.LIBCMT ref: 00D00938

Strings

H, xrefs: 00D008BD

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 514a5b645c3f43d94cef7fc84f9f5e6daae7e8810cf795ed12425f9524dc0459
Instruction ID: 91dac639d3bb91bba26a4190edae10151acf63c8b25168c7818ea26f587e2db5
Opcode Fuzzy Hash: 514a5b645c3f43d94cef7fc84f9f5e6daae7e8810cf795ed12425f9524dc0459
Instruction Fuzzy Hash: FDA12632A002489FDF19AF68E851BAD3FA0EB46320F18415DF919DB3D1D7359913DBA1

Function 00CC344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CC3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00D91418,?,00CC2E7F,?,?,?,00000000), ref: 00CC3A78

Part of subcall function 00CC3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00CC3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00CC356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00D0318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00D031CE
RegCloseKey.ADVAPI32(?), ref: 00D03210
_wcslen.LIBCMT ref: 00D03277
_wcslen.LIBCMT ref: 00D03286

Strings

Include, xrefs: 00D03184, 00D031C5
\Include\, xrefs: 00CC3527
Software\AutoIt v3\AutoIt, xrefs: 00CC3560
\, xrefs: 00D0328C

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 41f429d04058c1c0f1d0da12162e1599ebc12152e8faaf7124d7379ce6499a74
Instruction ID: ea65e241482c1e0063084350beb95d8f44e83d2e711d16eff332e88895ba6a3d
Opcode Fuzzy Hash: 41f429d04058c1c0f1d0da12162e1599ebc12152e8faaf7124d7379ce6499a74
Instruction Fuzzy Hash: AE716C71505301AEC714EF65EC86AABBBE8FF89740F40452EF545D32A1EB309A48DB72

Function 00CC2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00CC2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00CC2B9D
LoadIconW.USER32(00000063), ref: 00CC2BB3
LoadIconW.USER32(000000A4), ref: 00CC2BC5
LoadIconW.USER32(000000A2), ref: 00CC2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00CC2BEF
RegisterClassExW.USER32(?), ref: 00CC2C40

Part of subcall function 00CC2CD4: GetSysColorBrush.USER32(0000000F), ref: 00CC2D07
Part of subcall function 00CC2CD4: RegisterClassExW.USER32(00000030), ref: 00CC2D31
Part of subcall function 00CC2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00CC2D42
Part of subcall function 00CC2CD4: InitCommonControlsEx.COMCTL32(?), ref: 00CC2D5F
Part of subcall function 00CC2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00CC2D6F
Part of subcall function 00CC2CD4: LoadIconW.USER32(000000A9), ref: 00CC2D85
Part of subcall function 00CC2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00CC2D94

Strings

0, xrefs: 00CC2C0F
#, xrefs: 00CC2C16
AutoIt v3, xrefs: 00CC2C2F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 0f5310d4d0966830fbdc1cc3d50604b4803129ea86f4741bdd1692b9eb8c6d56
Instruction ID: 4522c2e657921fc823a6aa7a1f561689b2b1e7c72aeb7990b580532555955af9
Opcode Fuzzy Hash: 0f5310d4d0966830fbdc1cc3d50604b4803129ea86f4741bdd1692b9eb8c6d56
Instruction Fuzzy Hash: 2E210778E10319AFDB109FE5EC55AA97FB4FB48B51F14411BE904E67A0D7B11540CFA0

Function 00CC3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00CC316A,?,?), ref: 00CC31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00CC316A,?,?), ref: 00CC3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00CC3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00CC316A,?,?), ref: 00CC3232
CreatePopupMenu.USER32 ref: 00CC3246
PostQuitMessage.USER32(00000000), ref: 00CC3267

Strings

TaskbarCreated, xrefs: 00CC322D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: c6e808e3b200bb994f04f134df198d7c2717009fcbbfac747b1397d863706afe
Instruction ID: f6611b9ab02dcca8c2e6d2512055b4d77e22a301560950acfce45de398d0625e
Opcode Fuzzy Hash: c6e808e3b200bb994f04f134df198d7c2717009fcbbfac747b1397d863706afe
Instruction Fuzzy Hash: 0141D539254385AEDF151B78ED0DFBD3A29E705340F08811EF916C57D2C7619F40AAB1

Function 00CC2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00CC2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00CC2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00CC1CAD,?), ref: 00CC2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00CC1CAD,?), ref: 00CC2CCF

Strings

AutoIt v3, xrefs: 00CC2C89, 00CC2C8E, 00CC2C8F
edit, xrefs: 00CC2CAC

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 8e3f2506111a8a1c1810634fb5cc7da038b32598650948c3f57255953577fd9e
Instruction ID: 8c016f5f2dd93dacdc8603aea8bb7d165dd1ab677a9fb15d6bc636edfe5a4f00
Opcode Fuzzy Hash: 8e3f2506111a8a1c1810634fb5cc7da038b32598650948c3f57255953577fd9e
Instruction Fuzzy Hash: 68F0D4796503917EEB311B67AC08EB72EBDD7CAF61B00109AFD04E27A0C6711854DEB0

Function 00D2E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00D2E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00D2E9A5
Sleep.KERNEL32(00000000), ref: 00D2E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00D2E9B7
Sleep.KERNELBASE ref: 00D2E9F3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: b21f3fdcd7c02428a4d7f8bacb03e8a71db653b8fad3cfd8dd1954fb6b9c359e
Instruction ID: 349f1e56db7a357bf9173572f1dd5a95ccd07a5f31b8986747ccbebb3cbc6c70
Opcode Fuzzy Hash: b21f3fdcd7c02428a4d7f8bacb03e8a71db653b8fad3cfd8dd1954fb6b9c359e
Instruction Fuzzy Hash: 91010531D01B39DBCF00ABE5E859AEDBBB8BB29705F000556E942B2241DB3495948BB1

Function 00CC3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00CC3B0F,SwapMouseButtons,00000004,?), ref: 00CC3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00CC3B0F,SwapMouseButtons,00000004,?), ref: 00CC3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00CC3B0F,SwapMouseButtons,00000004,?), ref: 00CC3B83

Strings

Control Panel\Mouse, xrefs: 00CC3B3E

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: a4c4a41d9101432baa3912e3f81ba0fd588140d606e10fbcc3397d2558921576
Instruction ID: 5eb561386eb9e9f2c18906a0a7e9103f4f5e27432684aeb713d29a0f352755d2
Opcode Fuzzy Hash: a4c4a41d9101432baa3912e3f81ba0fd588140d606e10fbcc3397d2558921576
Instruction Fuzzy Hash: 911118B5520348FFDB208FA9EC54EAEB7B8EF04755B108459E805D7210D2319F409B60

Function 00CC3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00D033A2

Part of subcall function 00CC6B57: _wcslen.LIBCMT ref: 00CC6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00CC3A04

Strings

Line: , xrefs: 00D033EB

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: e4d3b43008c19c2f3e302fcd13dae698653e18f2c84c1cf366e332a7b49b78da
Instruction ID: d3605e8d34d7af6b987e354796fab1d5757022f80b66249af49d33a1e0e9b7e0
Opcode Fuzzy Hash: e4d3b43008c19c2f3e302fcd13dae698653e18f2c84c1cf366e332a7b49b78da
Instruction Fuzzy Hash: 9831C371508381AED725EB60EC45FEBB7ECAB40710F04892EF599931D1DB709A48D7E2

Function 00CDFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00CE0668

Part of subcall function 00CE32A4: RaiseException.KERNEL32(?,?,?,00CE068A,?,00D91444,?,?,?,?,?,?,00CE068A,00CC1129,00D88738,00CC1129), ref: 00CE3304

__CxxThrowException@8.LIBVCRUNTIME ref: 00CE0685

Strings

Unknown exception, xrefs: 00CE0692

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 7a756abbd7d78dbb279dd2dc47d6152a3a1ad5b73e829141c130fd946317fd32
Instruction ID: f82e784f1f9c97ecb35a5e0626d4ee0fd705eaacedc5e69685f61889d28a6558
Opcode Fuzzy Hash: 7a756abbd7d78dbb279dd2dc47d6152a3a1ad5b73e829141c130fd946317fd32
Instruction Fuzzy Hash: FFF0C83490038D77CB00BA66D846D5E777D6E00350BB04536BD24D6592EFB1EB5AE6D0

Function 00CC10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00CC1BF4
Part of subcall function 00CC1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00CC1BFC
Part of subcall function 00CC1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00CC1C07
Part of subcall function 00CC1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00CC1C12
Part of subcall function 00CC1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00CC1C1A
Part of subcall function 00CC1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00CC1C22

Part of subcall function 00CC1B4A: RegisterWindowMessageW.USER32(00000004,?,00CC12C4), ref: 00CC1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00CC136A
OleInitialize.OLE32 ref: 00CC1388
CloseHandle.KERNEL32(00000000,00000000), ref: 00D024AB

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: a0bd5664021806d4facadaa02e74a74045a40f406d3e45860c96c7ce6e357be5
Instruction ID: 51086dd7a10b8bcecea7d72cbeb1c40f4407bcef0110e61359fbafe67e51bbdf
Opcode Fuzzy Hash: a0bd5664021806d4facadaa02e74a74045a40f406d3e45860c96c7ce6e357be5
Instruction Fuzzy Hash: 7B71A8BC9113079FCB84EF6AE945A593AF0BB8934575A822FD81AC7361EB308445DF70

Function 00D2C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00CC3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00D2C259
KillTimer.USER32(?,00000001,?,?), ref: 00D2C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D2C270

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: e7671a9f13e61041a293fdb3b1875572b0c63b5cd4b48ae92e1114b15236954b
Instruction ID: bfa5bb90ef45fc0d47d9cdc1860b8a90443a48e41da0da98dade948ebfe158f3
Opcode Fuzzy Hash: e7671a9f13e61041a293fdb3b1875572b0c63b5cd4b48ae92e1114b15236954b
Instruction Fuzzy Hash: 3A31E370910364AFEB22CF649845BEBBBEC9F1630CF04109ED5DA93241C7745E84CB65

Function 00CF86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00CF85CC,?,00D88CC8,0000000C), ref: 00CF8704
GetLastError.KERNEL32(?,00CF85CC,?,00D88CC8,0000000C), ref: 00CF870E
__dosmaperr.LIBCMT ref: 00CF8739

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: ac9b76cb6004dc2802df94afe74320de4d2703ced805b0ef5d66840fbe73117c
Instruction ID: 87d3732feb1429b2d32efa4fc659420506b4f8cdab59c9906183751c4c893d88
Opcode Fuzzy Hash: ac9b76cb6004dc2802df94afe74320de4d2703ced805b0ef5d66840fbe73117c
Instruction Fuzzy Hash: 0B014233605B6C1AD6E47334784977E67854B82779F35011AFB24CB1E2DE70CD899153

Function 00CCDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00CCDB7B
DispatchMessageW.USER32(?), ref: 00CCDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00CCDB9F
Sleep.KERNELBASE(0000000A), ref: 00CCDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00D11CC9

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 6d013ea8e49f331127c55eb159d6931f781900f2478539e6e127ef130c5cfb0f
Instruction ID: 88279a9853bc1f4a3e12b0592df1e784be97b0d54cb3495a03a36067a5e33813
Opcode Fuzzy Hash: 6d013ea8e49f331127c55eb159d6931f781900f2478539e6e127ef130c5cfb0f
Instruction Fuzzy Hash: 74F08230654341ABEB30CBA0DC99FEA73ADEB88311F504629E61AC31C0EB309488DB75

Function 00CD1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00CD17F6

Strings

CALL, xrefs: 00CD17C6

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: d583419d8ca46027539b5daa4e712f11dc90854c1301b67e976f74eb92a9c6cc
Instruction ID: 9909ee5ac0a97b49a8cb9a9f8d3d4403568f41463ecf02841f76dcc01dd4b235
Opcode Fuzzy Hash: d583419d8ca46027539b5daa4e712f11dc90854c1301b67e976f74eb92a9c6cc
Instruction Fuzzy Hash: F1229C70608301AFC714DF15D480A6ABBF1FF85314F18895EFA968B3A1DB31E985DB92

Function 00CC2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00D02C8C

Part of subcall function 00CC3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00CC3A97,?,?,00CC2E7F,?,?,?,00000000), ref: 00CC3AC2

Part of subcall function 00CC2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00CC2DC4

Strings

X, xrefs: 00D02C5A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 329a5f7db5a9e8fdcd649253bf9bf30b40066e4ed3055c59128dbd6d3596813a
Instruction ID: eec51728749f053b9e631cc5ca7c6c4dd0215e8e6bba521149b9c1936b43eb73
Opcode Fuzzy Hash: 329a5f7db5a9e8fdcd649253bf9bf30b40066e4ed3055c59128dbd6d3596813a
Instruction Fuzzy Hash: A2218471A102989BDB01EF94C845BEE7BB89F48315F00805DE505B7381DBB499899F71

Function 00CFC9BB Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00CF2D74: GetLastError.KERNEL32(?,?,00CF5686,00D03CD6,?,00000000,?,00CF5B6A,?,?,?,?,?,00CEE6D1,?,00D88A48), ref: 00CF2D78
Part of subcall function 00CF2D74: _free.LIBCMT ref: 00CF2DAB
Part of subcall function 00CF2D74: SetLastError.KERNEL32(00000000,?,?,?,?,00CEE6D1,?,00D88A48,00000010,00CC4F4A,?,?,00000000,00D03CD6), ref: 00CF2DEC
Part of subcall function 00CF2D74: _abort.LIBCMT ref: 00CF2DF2

Part of subcall function 00CFCADA: _abort.LIBCMT ref: 00CFCB0C
Part of subcall function 00CFCADA: _free.LIBCMT ref: 00CFCB40

Part of subcall function 00CFC74F: GetOEMCP.KERNEL32(00000000), ref: 00CFC77A

_free.LIBCMT ref: 00CFCA33
_free.LIBCMT ref: 00CFCA69

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 0528e18c6279f9cecb501a80e3f9e7654130d1df750f7635567080ebf2241bf5
Instruction ID: c2e08f55876f1849e7926483c144e48d64ab598edd06002125bef9fc79b8fc4a
Opcode Fuzzy Hash: 0528e18c6279f9cecb501a80e3f9e7654130d1df750f7635567080ebf2241bf5
Instruction Fuzzy Hash: E531EC31A0420CEFDB50EF69D5817BD77F4EF40320F210199E614972A1EB766E41EB61

Function 00CC3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00CC3908

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: d4029110b5c7c81da0d1c50a07194005807175a0d57462b974f8c4b9b9ab2152
Instruction ID: 4f36aba1eedcfd7bdea6325cb7346cf2841422061504055cacb08f245a7eefbb
Opcode Fuzzy Hash: d4029110b5c7c81da0d1c50a07194005807175a0d57462b974f8c4b9b9ab2152
Instruction Fuzzy Hash: 74314C746047419FD721DF64E885B97BBF8FB49708F00092EF9A9C7290E771AA44CB62

Function 00CDF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00CDF661

Part of subcall function 00CCD730: GetInputState.USER32 ref: 00CCD807

Sleep.KERNEL32(00000000), ref: 00D1F2DE

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 3b2eb3118a8c2623bcc325b452c1674832cabbd16d48254abbd3e2109bdf7946
Instruction ID: b5178b93d65e24973c1973164e797f8e76e28820d6563da9003a384e5378223c
Opcode Fuzzy Hash: 3b2eb3118a8c2623bcc325b452c1674832cabbd16d48254abbd3e2109bdf7946
Instruction Fuzzy Hash: ADF05831240705AFD310EB69D44AF6AB7E8AB59761F00002AF85AC7360DB70A8008BA0

Function 00CCB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00CCBB4E

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: a677477fe6a2eed4a72c07169e06459789697a3080271f7faef5537e6fda778d
Instruction ID: 4042509e9d6da86468f5d8baa1d634de79f750756abdf952d05c5ed5b2a2c896
Opcode Fuzzy Hash: a677477fe6a2eed4a72c07169e06459789697a3080271f7faef5537e6fda778d
Instruction Fuzzy Hash: 90329F30A00209AFDB14DF94D895FBA7BB9EF44310F18805DE955AB351C775EE81CBA1

Function 00D52598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00D52649

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 894c015304392f2d6c73247ee11baaf5cfe28d9dacc0db30a08675da7b9402d2
Instruction ID: cd7bb8c461f6875094d5358b99d3ee30ed3c3e2948d88c4529ffd8fc37e0cb6d
Opcode Fuzzy Hash: 894c015304392f2d6c73247ee11baaf5cfe28d9dacc0db30a08675da7b9402d2
Instruction Fuzzy Hash: 8B21C274200616AFDB10DF18C8D0E36B799EB56369B54806CEC968B392D771ED49CBA0

Function 00D513B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00D51420

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 88427d987c6f8b220447ad6ceba06b2e924ce268e6246aff8b76b1706ed46769
Instruction ID: a8a10b56fe3ab3e5542b751fb8f197eb4b5e1687b6e3a88a818a4bc5077d3771
Opcode Fuzzy Hash: 88427d987c6f8b220447ad6ceba06b2e924ce268e6246aff8b76b1706ed46769
Instruction Fuzzy Hash: 42317174604612AFDB14DF29C491B69B7A1FF4532AF04816DEC594B292DB31EC45CBE0

Function 00CC4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00CC4EDD,?,00D91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00CC4E9C
Part of subcall function 00CC4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00CC4EAE
Part of subcall function 00CC4E90: FreeLibrary.KERNEL32(00000000,?,?,00CC4EDD,?,00D91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00CC4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00D91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00CC4EFD

Part of subcall function 00CC4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00D03CDE,?,00D91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00CC4E62
Part of subcall function 00CC4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00CC4E74
Part of subcall function 00CC4E59: FreeLibrary.KERNEL32(00000000,?,?,00D03CDE,?,00D91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00CC4E87

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 3db3140b75e138de6ce307888f90a640962251d190622759885dc93d23c88256
Instruction ID: 36a9460d5e60eaaad6c5c4e32a5a56265ae0aff6119d5dc60325e070ce5ed4cf
Opcode Fuzzy Hash: 3db3140b75e138de6ce307888f90a640962251d190622759885dc93d23c88256
Instruction Fuzzy Hash: 12110632610305AADF18FFA4DC22FAD77A5AF50711F10C42DF542E61D1EEB1AE45A760

Function 00CF8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00CF8440

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 69dfcbb036a87467f6b691184b6ccdf7162382ef7d61c403142640334e5af6a9
Instruction ID: 8944cd0cef3e9df50c815da74ff5e33e827bf41a7fc94f359c6461c3c51ef5a2
Opcode Fuzzy Hash: 69dfcbb036a87467f6b691184b6ccdf7162382ef7d61c403142640334e5af6a9
Instruction Fuzzy Hash: A511487190420AAFCB05DF58E941AAE7BF4EF48304F144059F908AB312DB30DA15CBA5

Function 00D529BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,00D514B5,?), ref: 00D52A01

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: b7e6472df6931f35efd25e48e69d925dcb49f64a45548f6b934277b64216f8d3
Instruction ID: 6c884d00921acf0983a2fe627df372a1804a7b38b83885d3784e4c98ba0f0e3b
Opcode Fuzzy Hash: b7e6472df6931f35efd25e48e69d925dcb49f64a45548f6b934277b64216f8d3
Instruction Fuzzy Hash: 140192363406419FEB258A2CC494B3237A2EB86316F2D8468CC478B251D732EC4ACBB0

Function 00CEE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 762744d7b99e1d66bea3baad5b42d20cb14b72bea2d4cfe092ae3c8b4afd6e77
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 28F0F432511A5CD7CA313A6B9C05BAA339C9F523B4F100715F621931D2DF70D906A6A6

Function 00D5149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 00D514EB

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8f7004d8cca21601fc0b69d344f89f21f2063d43f7f43c3ba3c574c54214af50
Instruction ID: d958078918d39d47ff32c1bc05f5073526efdeaf5bb9a8fa467ac1c70910b2ee
Opcode Fuzzy Hash: 8f7004d8cca21601fc0b69d344f89f21f2063d43f7f43c3ba3c574c54214af50
Instruction Fuzzy Hash: 5C01D4393047419F9B20CF69C480926BB95FF85325754805DEC4A8B702D632DD86CBA0

Function 00CF3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00D91444,?,00CDFDF5,?,?,00CCA976,00000010,00D91440,00CC13FC,?,00CC13C6,?,00CC1129), ref: 00CF3852

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9c17a3e0464ff67f956872b854681dd815ce1f1322ebd4dddb02b69e212495e7
Instruction ID: ebfb406fba762e0789a5b4585e1073961189c4df520e9beafadebe703384c59a
Opcode Fuzzy Hash: 9c17a3e0464ff67f956872b854681dd815ce1f1322ebd4dddb02b69e212495e7
Instruction Fuzzy Hash: 07E0E5312003EDB6D7A126779D00BBA3758AB427F0F150023BE24966C0DB19DF0191F2

Function 00CC4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00D91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00CC4F6D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: fafca5a6cfee953449f8ee73da6e67a2aa54e30f718434667ac4bf57c0777a5f
Instruction ID: 7c0975990942e66aaf41b43361239a0406a3f9fe89c2a8c0ab0661cfab961acd
Opcode Fuzzy Hash: fafca5a6cfee953449f8ee73da6e67a2aa54e30f718434667ac4bf57c0777a5f
Instruction Fuzzy Hash: 21F03971105752CFDB389FA5D4A0E22BBE4AF14329320C97EE5EA82621CB319844EF10

Function 00D52A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00D52A66

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 1e8f84f8cd6f8f1407f7193ce1a5d00aee4a43617b997d05b85d1a8b9527d714
Instruction ID: 00bd1c8ea8a35f3a3a4d365f60882e93ef147a2d5050fc7f74a4a90c485b0e29
Opcode Fuzzy Hash: 1e8f84f8cd6f8f1407f7193ce1a5d00aee4a43617b997d05b85d1a8b9527d714
Instruction Fuzzy Hash: 5BE04F36354226AACB14EA30EC808FA735CEB65396B104536FC56D2150DB34DA9986B0

Function 00CC2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00CC2DC4

Part of subcall function 00CC6B57: _wcslen.LIBCMT ref: 00CC6B6A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 8fa9debec97ed060e4f78a460b2fa6f3f159907a5c5153c976925a4db3240f03
Instruction ID: 1f19a48c6ac5725a45621209d62c4588ce35a7a61f9118fea5e23e5841ba9648
Opcode Fuzzy Hash: 8fa9debec97ed060e4f78a460b2fa6f3f159907a5c5153c976925a4db3240f03
Instruction Fuzzy Hash: C8E0C276A043245BCB20E298DC06FEA77EDDFC8791F0400B5FD0DE7248DA60AD8086A0

Function 00CC2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00CC3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00CC3908

Part of subcall function 00CCD730: GetInputState.USER32 ref: 00CCD807

SetCurrentDirectoryW.KERNEL32(?), ref: 00CC2B6B

Part of subcall function 00CC30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00CC314E

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: eab8f2363ee2497ce8a13b50e23cd5564724ad91d473b5a58322b8eef2508917
Instruction ID: e6120812f02d7ac3ccdb8948abc6a1ca81b3dfbd182137e888b4fe9b5e79741e
Opcode Fuzzy Hash: eab8f2363ee2497ce8a13b50e23cd5564724ad91d473b5a58322b8eef2508917
Instruction Fuzzy Hash: C1E0862230438907CB04BB74E856F7DB7599BD5351F40553EF143872A2CE248A465361

Function 00D23D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00D23D18

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: bec08e071901a9934bdd3d4f2280ea13c83b7259069521c135e01963b0335353
Instruction ID: 2fc71dc697d84eb9e6d978ac5db1c1e7c76260a84fd55d9106f6bcd284473171
Opcode Fuzzy Hash: bec08e071901a9934bdd3d4f2280ea13c83b7259069521c135e01963b0335353
Instruction Fuzzy Hash: 7ED012E06A03087EFB0083718C0BEBB329CC316A82F004BA47E02D65C1D9A0DE080130

Function 00D0039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00D00704,?,?,00000000,?,00D00704,00000000,0000000C), ref: 00D003B7

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8527837710f5286377998e630964423cbbd01e3d591296867f181fddf7259a1e
Instruction ID: 2591ce60beaa8e33bd459c248c3c744931c34250b73d2aae90a7bde125a725e7
Opcode Fuzzy Hash: 8527837710f5286377998e630964423cbbd01e3d591296867f181fddf7259a1e
Instruction Fuzzy Hash: 71D06C3205020DBFDF028F84DD06EDA3BAAFB48714F014000BE1896120C732E821AB90

Function 00CC1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00CC1CBC

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: f95d20eb8a90199bf29d912bdf5490300266957ea06c5a499d043a1d5e0bea4a
Instruction ID: 837feb311e988aeb71c29fcbeea5fdc4947a85752cf9af327b4f6ecf87bc9048
Opcode Fuzzy Hash: f95d20eb8a90199bf29d912bdf5490300266957ea06c5a499d043a1d5e0bea4a
Instruction Fuzzy Hash: DBC0923A280305AFF2148BD0BC4AF207774A348B01F448002FA0DE9BE3D3B22820EA70

Non-executed Functions

Function 00D59576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00CD9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00D5961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D5965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00D5969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D596C9
SendMessageW.USER32 ref: 00D596F2
GetKeyState.USER32(00000011), ref: 00D5978B
GetKeyState.USER32(00000009), ref: 00D59798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D597AE
GetKeyState.USER32(00000010), ref: 00D597B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D597E9
SendMessageW.USER32 ref: 00D59810
SendMessageW.USER32(?,00001030,?,00D57E95), ref: 00D59918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00D5992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00D59941
SetCapture.USER32(?), ref: 00D5994A
ClientToScreen.USER32(?,?), ref: 00D599AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00D599BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00D599D6
ReleaseCapture.USER32 ref: 00D599E1
GetCursorPos.USER32(?), ref: 00D59A19
ScreenToClient.USER32(?,?), ref: 00D59A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00D59A80
SendMessageW.USER32 ref: 00D59AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00D59AEB
SendMessageW.USER32 ref: 00D59B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00D59B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00D59B4A
GetCursorPos.USER32(?), ref: 00D59B68
ScreenToClient.USER32(?,?), ref: 00D59B75
GetParent.USER32(?), ref: 00D59B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00D59BFA
SendMessageW.USER32 ref: 00D59C2B
ClientToScreen.USER32(?,?), ref: 00D59C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00D59CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00D59CDE
SendMessageW.USER32 ref: 00D59D01
ClientToScreen.USER32(?,?), ref: 00D59D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00D59D82

Part of subcall function 00CD9944: GetWindowLongW.USER32(?,000000EB), ref: 00CD9952

GetWindowLongW.USER32(?,000000F0), ref: 00D59E05

Strings

@GUI_DRAGID, xrefs: 00D5997D
F, xrefs: 00D59D07

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: fffc36340b8d698e3901aa5cbe44ae77c34be4a32949c20dccbbe8b8dc695f33
Instruction ID: b66dce7807100b184c1029d2a58a29eed2b764b37607ceb43ca5b281656164b1
Opcode Fuzzy Hash: fffc36340b8d698e3901aa5cbe44ae77c34be4a32949c20dccbbe8b8dc695f33
Instruction Fuzzy Hash: 54426B34204301EFDB25CF24CD64AAABBE5EF49312F14061AFE99872A1D731E958DF61

Function 00D54873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00D548F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00D54908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00D54927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00D5494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00D5495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00D5497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00D549AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00D549D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00D54A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00D54A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00D54A7E
IsMenu.USER32(?), ref: 00D54A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00D54AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00D54B20
GetWindowLongW.USER32(?,000000F0), ref: 00D54B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00D54BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00D54C82
wsprintfW.USER32 ref: 00D54CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00D54CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00D54CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00D54D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00D54D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00D54D5A

Strings

%d/%02d/%02d, xrefs: 00D54CA8

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 28de04d8d962081f894ab89f30b8119734694e122db2e91ff85636f66ccc325c
Instruction ID: 752943c1af8653edeb79f1183d8f31274eab990f51e3874803f8a68d518bb00a
Opcode Fuzzy Hash: 28de04d8d962081f894ab89f30b8119734694e122db2e91ff85636f66ccc325c
Instruction Fuzzy Hash: 7012DE71600314ABEF248F28CC49FAE7BB8EF4531AF144119FD16DA2A1DB74DA85CB61

Function 00CDF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00CDF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D1F474
IsIconic.USER32(00000000), ref: 00D1F47D
ShowWindow.USER32(00000000,00000009), ref: 00D1F48A
SetForegroundWindow.USER32(00000000), ref: 00D1F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00D1F4AA
GetCurrentThreadId.KERNEL32 ref: 00D1F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00D1F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00D1F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00D1F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00D1F4DE
SetForegroundWindow.USER32(00000000), ref: 00D1F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D1F4F6
keybd_event.USER32(00000012,00000000), ref: 00D1F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D1F50B
keybd_event.USER32(00000012,00000000), ref: 00D1F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D1F519
keybd_event.USER32(00000012,00000000), ref: 00D1F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D1F528
keybd_event.USER32(00000012,00000000), ref: 00D1F52D
SetForegroundWindow.USER32(00000000), ref: 00D1F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00D1F557

Strings

Shell_TrayWnd, xrefs: 00D1F46F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: f531f97ab368edc7e00e716d9caad2294da06ff0109f5109d513885ff760fd2e
Instruction ID: 1ab037338adf72685082ed3191c4834feb519e435198f1712fc0d6fbf19867fc
Opcode Fuzzy Hash: f531f97ab368edc7e00e716d9caad2294da06ff0109f5109d513885ff760fd2e
Instruction Fuzzy Hash: 1F31B471A50318BFFB206BB59C4AFBF7E6DEB44B51F141065FA00E62D1DAB09D40AA70

Function 00D21201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00D216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D2170D
Part of subcall function 00D216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D2173A
Part of subcall function 00D216C3: GetLastError.KERNEL32 ref: 00D2174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00D21286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00D212A8
CloseHandle.KERNEL32(?), ref: 00D212B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00D212D1
GetProcessWindowStation.USER32 ref: 00D212EA
SetProcessWindowStation.USER32(00000000), ref: 00D212F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00D21310

Part of subcall function 00D210BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00D211FC), ref: 00D210D4
Part of subcall function 00D210BF: CloseHandle.KERNEL32(?,?,00D211FC), ref: 00D210E9

Strings

winsta0, xrefs: 00D212CC
default, xrefs: 00D2130B
, xrefs: 00D2125A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: bd25c259eb97fee3c314fa609510441088f4e4905ea4515d1c45bd7b39322811
Instruction ID: bd9804f18bb73931263cb54375e73296b48f51335898daade1de7f73bcbd4d7a
Opcode Fuzzy Hash: bd25c259eb97fee3c314fa609510441088f4e4905ea4515d1c45bd7b39322811
Instruction Fuzzy Hash: 6E818E75900319AFDF109FA4EC49BEE7BB9EF24708F188119F915E62A0C7319A45CB70

Function 00D20B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00D21114
Part of subcall function 00D210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00D20B9B,?,?,?), ref: 00D21120
Part of subcall function 00D210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00D20B9B,?,?,?), ref: 00D2112F
Part of subcall function 00D210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00D20B9B,?,?,?), ref: 00D21136
Part of subcall function 00D210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00D2114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00D20BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00D20C00
GetLengthSid.ADVAPI32(?), ref: 00D20C17
GetAce.ADVAPI32(?,00000000,?), ref: 00D20C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00D20C6D
GetLengthSid.ADVAPI32(?), ref: 00D20C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00D20C8C
HeapAlloc.KERNEL32(00000000), ref: 00D20C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00D20CB4
CopySid.ADVAPI32(00000000), ref: 00D20CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00D20CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00D20D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00D20D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D20D45
HeapFree.KERNEL32(00000000), ref: 00D20D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D20D55
HeapFree.KERNEL32(00000000), ref: 00D20D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D20D65
HeapFree.KERNEL32(00000000), ref: 00D20D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00D20D78
HeapFree.KERNEL32(00000000), ref: 00D20D7F

Part of subcall function 00D21193: GetProcessHeap.KERNEL32(00000008,00D20BB1,?,00000000,?,00D20BB1,?), ref: 00D211A1
Part of subcall function 00D21193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00D20BB1,?), ref: 00D211A8
Part of subcall function 00D21193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00D20BB1,?), ref: 00D211B7

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 198411b215666028a78d37bd8c212a80e24ede1ab942740df5419e9f1df6a307
Instruction ID: f9f2046280b15dd0ccee4626ac288eab8a08b20d6a013c8cb63393f75e9264ad
Opcode Fuzzy Hash: 198411b215666028a78d37bd8c212a80e24ede1ab942740df5419e9f1df6a307
Instruction Fuzzy Hash: 78713676A0131AAFDF109FA4EC44BEEBBB8AF14315F084515E914E6292DB71AA05CB70

Function 00D3EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00D5CC08), ref: 00D3EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00D3EB37
GetClipboardData.USER32(0000000D), ref: 00D3EB43
CloseClipboard.USER32 ref: 00D3EB4F
GlobalLock.KERNEL32(00000000), ref: 00D3EB87
CloseClipboard.USER32 ref: 00D3EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00D3EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00D3EBC9
GetClipboardData.USER32(00000001), ref: 00D3EBD1
GlobalLock.KERNEL32(00000000), ref: 00D3EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 00D3EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00D3EC38
GetClipboardData.USER32(0000000F), ref: 00D3EC44
GlobalLock.KERNEL32(00000000), ref: 00D3EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00D3EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00D3EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00D3ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 00D3ECF3
CountClipboardFormats.USER32 ref: 00D3ED14
CloseClipboard.USER32 ref: 00D3ED59

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 4448654b0411e2bbef098919dd310ebd85aa72f84d7e0b72dd2fa59653d73993
Instruction ID: 321da82eadf67730d6579acd449661070d3d9f03a92f059b8da7d0b1c224d1b1
Opcode Fuzzy Hash: 4448654b0411e2bbef098919dd310ebd85aa72f84d7e0b72dd2fa59653d73993
Instruction Fuzzy Hash: F6618834204302AFD300EF24D899F6AB7A4AF84704F18555DF896D72E2DB71E906DBB2

Function 00D3698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00D369BE
FindClose.KERNEL32(00000000), ref: 00D36A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D36A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D36A75

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00D36AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D36ADF

Strings

%02d, xrefs: 00D36C00, 00D36C0A, 00D36C5A, 00D36CAA, 00D36CFA, 00D36D4A
%4d%02d%02d%02d%02d%02d, xrefs: 00D36B6A
%4d, xrefs: 00D36BB1
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00D36B32
%03d, xrefs: 00D36DA2

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: ef3eca8139b6c8ac7082586f5ee6e8c1dd51f5c72844243b0a6a82f4f26979f3
Instruction ID: 7694a5233c8c0c030f10b07b5096633615775efa03a51690d6ffbe8416c7dbf6
Opcode Fuzzy Hash: ef3eca8139b6c8ac7082586f5ee6e8c1dd51f5c72844243b0a6a82f4f26979f3
Instruction Fuzzy Hash: 63D14072508300AFC714EBA4C985EABB7ECEF88704F04491DF589D7291EB74DA48DB62

Function 00D39642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00D39663
GetFileAttributesW.KERNEL32(?), ref: 00D396A1
SetFileAttributesW.KERNEL32(?,?), ref: 00D396BB
FindNextFileW.KERNEL32(00000000,?), ref: 00D396D3
FindClose.KERNEL32(00000000), ref: 00D396DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00D396FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00D3974A
SetCurrentDirectoryW.KERNEL32(00D86B7C), ref: 00D39768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D39772
FindClose.KERNEL32(00000000), ref: 00D3977F
FindClose.KERNEL32(00000000), ref: 00D3978F

Strings

*.*, xrefs: 00D396F5

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: b283dbdef6e592a69dabd1f88cadb758112fd351229875371607f3abe9d53f67
Instruction ID: 43ac276155b04a603a86a9e175a7ba16cc9bd4f1059c0c18c09f4ac876c0fabc
Opcode Fuzzy Hash: b283dbdef6e592a69dabd1f88cadb758112fd351229875371607f3abe9d53f67
Instruction Fuzzy Hash: 2231F37255131A6FDF14AFB4DC59AEEB7AC9F09322F144055F905E21E0DBB0DD448A34

Function 00D3979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00D397BE
FindNextFileW.KERNEL32(00000000,?), ref: 00D39819
FindClose.KERNEL32(00000000), ref: 00D39824
FindFirstFileW.KERNEL32(*.*,?), ref: 00D39840
SetCurrentDirectoryW.KERNEL32(?), ref: 00D39890
SetCurrentDirectoryW.KERNEL32(00D86B7C), ref: 00D398AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D398B8
FindClose.KERNEL32(00000000), ref: 00D398C5
FindClose.KERNEL32(00000000), ref: 00D398D5

Part of subcall function 00D2DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00D2DB00

Strings

*.*, xrefs: 00D3983B

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 384607fac87cebe7ff5e47700f09e52f8c1aa729b86f3acd550db3fe1891aeea
Instruction ID: 5df71c9aa3931aae72f6554713073fcb14d3ea0b3d308623ed8c832bcaf85dc9
Opcode Fuzzy Hash: 384607fac87cebe7ff5e47700f09e52f8c1aa729b86f3acd550db3fe1891aeea
Instruction Fuzzy Hash: AF31E37250031A6EDF10AFB4EC58ADEB7AC9F46325F144156E814E21A0DBB0DD49CB74

Function 00D4BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D4B6AE,?,?), ref: 00D4C9B5
Part of subcall function 00D4C998: _wcslen.LIBCMT ref: 00D4C9F1
Part of subcall function 00D4C998: _wcslen.LIBCMT ref: 00D4CA68
Part of subcall function 00D4C998: _wcslen.LIBCMT ref: 00D4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D4BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00D4BFA9
RegCloseKey.ADVAPI32(00000000), ref: 00D4BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00D4C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00D4C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00D4C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00D4C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00D4C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00D4C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00D4C382
RegCloseKey.ADVAPI32(00000000), ref: 00D4C38F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: dbb8b3b034d0bc27693da8baee3e94c66cf836e959d2c1e6494475ee8057a8f5
Instruction ID: 3c48a5ec693ab3d818817fbe174d22fd3e417f11010d5ea74a8849ca2f024645
Opcode Fuzzy Hash: dbb8b3b034d0bc27693da8baee3e94c66cf836e959d2c1e6494475ee8057a8f5
Instruction Fuzzy Hash: C5024D716142009FC754CF28C895E2ABBE5EF89314F18C49DF88ADB2A2D731EC45CB61

Function 00D38195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00D38257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D38267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00D38273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00D38310
SetCurrentDirectoryW.KERNEL32(?), ref: 00D38324
SetCurrentDirectoryW.KERNEL32(?), ref: 00D38356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00D3838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00D38395

Strings

*.*, xrefs: 00D3839B

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: e07415c46e5e0a30d064c29b9769cd7eaea1b361f33739c4eddee9153463982b
Instruction ID: 4104a6130bb12f18636d7204f5fa9444a8b60c6277b71967610549d37a284f39
Opcode Fuzzy Hash: e07415c46e5e0a30d064c29b9769cd7eaea1b361f33739c4eddee9153463982b
Instruction Fuzzy Hash: EF6159B25043459FC710EF64C881AAEB3E8FF89314F04892EF989C7251DB35E945DBA2

Function 00D2D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00CC3A97,?,?,00CC2E7F,?,?,?,00000000), ref: 00CC3AC2

Part of subcall function 00D2E199: GetFileAttributesW.KERNEL32(?,00D2CF95), ref: 00D2E19A

FindFirstFileW.KERNEL32(?,?), ref: 00D2D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00D2D1DD
MoveFileW.KERNEL32(?,?), ref: 00D2D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00D2D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D2D237

Part of subcall function 00D2D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00D2D21C,?,?), ref: 00D2D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00D2D253
FindClose.KERNEL32(00000000), ref: 00D2D264

Strings

\*.*, xrefs: 00D2D0CD, 00D2D0D6, 00D2D0EB

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 6e6f0acdc77e8371a225c93376eb68240fc81f095a1935cd2a15362477a24469
Instruction ID: b7d1172e44c411ba9872c010e8122185d9a233e80c3218f2fe00bd0b7b8f2e86
Opcode Fuzzy Hash: 6e6f0acdc77e8371a225c93376eb68240fc81f095a1935cd2a15362477a24469
Instruction Fuzzy Hash: F2615C3180125D9ECF05EBE0EA92EEDB776AF65304F244169E402771A1EB30AF09DB74

Function 00D3ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00D3ED91
EmptyClipboard.USER32 ref: 00D3ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00D3EDAC
CloseClipboard.USER32 ref: 00D3EEA3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 9f919c76cc02b27c248ffceb18cb0f63c1a444d79ba22f292ce3c4d56a7b956e
Instruction ID: 4a725feb92590617f1c6eb4d3ce9320fb0c913127d8ba736604c4e5e5de405cf
Opcode Fuzzy Hash: 9f919c76cc02b27c248ffceb18cb0f63c1a444d79ba22f292ce3c4d56a7b956e
Instruction Fuzzy Hash: 35417C35204711AFD710DF15E888F1ABBA5EF44319F188099E8599B7A2C735ED42CBA0

Function 00D2E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00D216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D2170D
Part of subcall function 00D216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D2173A
Part of subcall function 00D216C3: GetLastError.KERNEL32 ref: 00D2174A

ExitWindowsEx.USER32(?,00000000), ref: 00D2E932

Strings

SeShutdownPrivilege, xrefs: 00D2E902
, xrefs: 00D2E95C
, xrefs: 00D2E920
@, xrefs: 00D2E925

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: ac9a6c870d760eb9883db15a277de7b8c0d2ba06542ad4c6310b8633aa0f726b
Instruction ID: 782e2c3093067aa57d7a5f83ca9affa9b5f36aebc17f07be6b7c7f5bafc85a82
Opcode Fuzzy Hash: ac9a6c870d760eb9883db15a277de7b8c0d2ba06542ad4c6310b8633aa0f726b
Instruction Fuzzy Hash: 1D01DB72620331AFEB5427B4BC85BBF735C9734759F194423FC02E21D1D5609C8489B4

Function 00D41204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00D41276
WSAGetLastError.WSOCK32 ref: 00D41283
bind.WSOCK32(00000000,?,00000010), ref: 00D412BA
WSAGetLastError.WSOCK32 ref: 00D412C5
closesocket.WSOCK32(00000000), ref: 00D412F4
listen.WSOCK32(00000000,00000005), ref: 00D41303
WSAGetLastError.WSOCK32 ref: 00D4130D
closesocket.WSOCK32(00000000), ref: 00D4133C

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 231db58d21692f1d958518f82dda10a255d705bf6825aedf4fcbfa9aaac98fb0
Instruction ID: 272b2bbae3d2e0c01eeb6102dd7ef76c428a3d779f646e7c725170050267049a
Opcode Fuzzy Hash: 231db58d21692f1d958518f82dda10a255d705bf6825aedf4fcbfa9aaac98fb0
Instruction Fuzzy Hash: 4E415D35A002509FD710DF68C4C9B2ABBE5AF46318F188198E856DF396C771ED85CBB1

Function 00D2D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00CC3A97,?,?,00CC2E7F,?,?,?,00000000), ref: 00CC3AC2

Part of subcall function 00D2E199: GetFileAttributesW.KERNEL32(?,00D2CF95), ref: 00D2E19A

FindFirstFileW.KERNEL32(?,?), ref: 00D2D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00D2D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D2D481
FindClose.KERNEL32(00000000), ref: 00D2D498
FindClose.KERNEL32(00000000), ref: 00D2D4A1

Strings

\*.*, xrefs: 00D2D3F2

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 8712f830963d27f5fbcb22429a508e8b4870d5e05c26ac6028014a27e4665b61
Instruction ID: 48315be5fe2be28b8d5738ed5a0f376685e0dcc8f0213cfd9236233962ad604a
Opcode Fuzzy Hash: 8712f830963d27f5fbcb22429a508e8b4870d5e05c26ac6028014a27e4665b61
Instruction Fuzzy Hash: 5B318F310183959FC200EF60E855DAF77A8AEA1309F444A1DF4D1931A1EB30EA099766

Function 00CFE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00CFE645

Strings

1#QNAN, xrefs: 00CFF84B
1#IND, xrefs: 00CFF83D
1#INF, xrefs: 00CFF852
1#SNAN, xrefs: 00CFF844

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 49db60e45a48cd101c72d8f04ac20d9d181e8f68965bd7cbf60177d2db8cd21f
Instruction ID: d19c54ef2b5a805b2b86aefa805ff22be2f551c781273dd6e82bc28e46e230c5
Opcode Fuzzy Hash: 49db60e45a48cd101c72d8f04ac20d9d181e8f68965bd7cbf60177d2db8cd21f
Instruction Fuzzy Hash: E9C23872E0862C8FDBA5CE289D407EAB7B5EF44304F1441EAD95DE7250E774AE828F41

Function 00D3648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D364DC
CoInitialize.OLE32(00000000), ref: 00D36639
CoCreateInstance.OLE32(00D5FCF8,00000000,00000001,00D5FB68,?), ref: 00D36650
CoUninitialize.OLE32 ref: 00D368D4

Strings

.lnk, xrefs: 00D364BA, 00D36524, 00D365E0

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 83b331c8199d38d34e29a6739246c35f6f0e5c64a6509e0d4b3b950e495ddcd8
Instruction ID: eacb90384f124a126fcb4a1490bfef92eaf12f1c767e35b7cc09cfc55075964c
Opcode Fuzzy Hash: 83b331c8199d38d34e29a6739246c35f6f0e5c64a6509e0d4b3b950e495ddcd8
Instruction Fuzzy Hash: 91D14A71508301AFC304EF24C881E6BB7E8FF99704F04896DF5958B2A1DB70E949CBA2

Function 00D422DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00D422E8

Part of subcall function 00D3E4EC: GetWindowRect.USER32(?,?), ref: 00D3E504

GetDesktopWindow.USER32 ref: 00D42312
GetWindowRect.USER32(00000000), ref: 00D42319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00D42355
GetCursorPos.USER32(?), ref: 00D42381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00D423DF

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 43380902351e3c39ba26e0bbdd2adf9d5fd1d87101c4208d92dddfe98db473db
Instruction ID: 1da308603b6225ae7e05851a08461c663003cca29b866284cdf14e247166a813
Opcode Fuzzy Hash: 43380902351e3c39ba26e0bbdd2adf9d5fd1d87101c4208d92dddfe98db473db
Instruction Fuzzy Hash: F131CD72504315AFCB20DF54D849A6BBBA9FF88314F44091DF985D7291DB34EA08CBA2

Function 00D39B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00D39B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00D39C8B

Part of subcall function 00D33874: GetInputState.USER32 ref: 00D338CB
Part of subcall function 00D33874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D33966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00D39BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00D39C75

Strings

*.*, xrefs: 00D39B5D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 092c74209d6c01fefd873a618b8f1bc26aedc25196d66c42ab2fdf43a9858e97
Instruction ID: e2e6a7df5250cee81f3b30073380752916eea3af43afbed4217d9a009a568ad4
Opcode Fuzzy Hash: 092c74209d6c01fefd873a618b8f1bc26aedc25196d66c42ab2fdf43a9858e97
Instruction Fuzzy Hash: 0241817190420AAFCF14DFA4D899BEEBBB8EF05311F284159E805A3191EB709E84DF70

Function 00CD997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00CD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00CD9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00CD9A4E
GetSysColor.USER32(0000000F), ref: 00CD9B23
SetBkColor.GDI32(?,00000000), ref: 00CD9B36

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: f45f7b239f7a6d25612b1e1e0566ac3087671b4b3fe91b216e96fe73f3778d66
Instruction ID: 4973555b8747a869dfb782c59da7904160521b658bb0fbc14cfeedaa36a53c8b
Opcode Fuzzy Hash: f45f7b239f7a6d25612b1e1e0566ac3087671b4b3fe91b216e96fe73f3778d66
Instruction Fuzzy Hash: 62A12A75208504BEEB24AA3D9C98EBB36ADDB46340F15020BFA16C67E1DE35DE41E271

Function 00D41806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00D4307A
Part of subcall function 00D4304E: _wcslen.LIBCMT ref: 00D4309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00D4185D
WSAGetLastError.WSOCK32 ref: 00D41884
bind.WSOCK32(00000000,?,00000010), ref: 00D418DB
WSAGetLastError.WSOCK32 ref: 00D418E6
closesocket.WSOCK32(00000000), ref: 00D41915

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 39fd5c3f049434e7ec81a0b3922fa8c7b5924b8d412c170c48d90b81ba826e87
Instruction ID: 8f7e7e7d821d12fec373c57cdff6d93911cf9ebee961a0baaeedec4cc21a9b82
Opcode Fuzzy Hash: 39fd5c3f049434e7ec81a0b3922fa8c7b5924b8d412c170c48d90b81ba826e87
Instruction Fuzzy Hash: F351B375A00210AFDB10AF24C886F2A7BE5EB44718F18805CF9569F3D3C771AD819BA1

Function 00D51C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00D51CC0
IsWindowEnabled.USER32 ref: 00D51CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00D51CDB
IsIconic.USER32 ref: 00D51CE9
IsZoomed.USER32 ref: 00D51CF7

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: dfeb6b572615577e9523012ecca0181bc6ecb9a6b4d42a1d408381ead75481b3
Instruction ID: 9d029e9fe0aa750f61949128805237241fc441ca26d445077b5d33da54eb5264
Opcode Fuzzy Hash: dfeb6b572615577e9523012ecca0181bc6ecb9a6b4d42a1d408381ead75481b3
Instruction Fuzzy Hash: 5B217E357403115FDB208F1AC884B6ABBA5AF95316B198058EC4ACB351DB72ED4ACBB0

Function 00CC8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00CC813C
VUUU, xrefs: 00D05DF0
VUUU, xrefs: 00CC843C
VUUU, xrefs: 00CC83E8
VUUU, xrefs: 00CC83FA

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 4e9538dee8af4826ce67c5120f8c4ee9f245897ec5debbe8ca7090a29636d1b3
Instruction ID: 4290cec70efcc381a3c4da80a36b8a646e74f5fa329131780ab76b98cbffc3eb
Opcode Fuzzy Hash: 4e9538dee8af4826ce67c5120f8c4ee9f245897ec5debbe8ca7090a29636d1b3
Instruction Fuzzy Hash: 76A27370D0061ACBDF24CF59C844BAEB7B1BF54310F28819AE859A7285EB74DE95CF60

Function 00D4A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00D4A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00D4A6BA

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

Process32NextW.KERNEL32(00000000,?), ref: 00D4A79C
CloseHandle.KERNEL32(00000000), ref: 00D4A7AB

Part of subcall function 00CDCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00D03303,?), ref: 00CDCE8A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 1ae5b1838ecccaf515cd6710e7bc906211b8cf21fd51248de49349e5d735115f
Instruction ID: 6bdb48492adbee3fd235d465a24a93a19a97374d80d17f167de3eaf01fc66303
Opcode Fuzzy Hash: 1ae5b1838ecccaf515cd6710e7bc906211b8cf21fd51248de49349e5d735115f
Instruction Fuzzy Hash: BD512B71508701AFD710EF28C886E6BBBE8FF89754F44491DF589972A1EB30D904DBA2

Function 00D2AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00D2AAAC
SetKeyboardState.USER32(00000080), ref: 00D2AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00D2AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00D2AB88

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 75605ecef8e4c7a544c888fdc5b99ecaa807487704a8bc1538a2359287971c27
Instruction ID: 970ae38863710e438a62adb60c3a2b785281afd905c32b94bb54be7a7a520cfb
Opcode Fuzzy Hash: 75605ecef8e4c7a544c888fdc5b99ecaa807487704a8bc1538a2359287971c27
Instruction Fuzzy Hash: 94311A30A40328AFFB358A6CAC05BFA77A6EF64318F08421AF591961E0D3758985C772

Function 00CFBB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CFBB7F

Part of subcall function 00CF29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00CFD7D1,00000000,00000000,00000000,00000000,?,00CFD7F8,00000000,00000007,00000000,?,00CFDBF5,00000000), ref: 00CF29DE
Part of subcall function 00CF29C8: GetLastError.KERNEL32(00000000,?,00CFD7D1,00000000,00000000,00000000,00000000,?,00CFD7F8,00000000,00000007,00000000,?,00CFDBF5,00000000,00000000), ref: 00CF29F0

GetTimeZoneInformation.KERNEL32 ref: 00CFBB91
WideCharToMultiByte.KERNEL32(00000000,?,00D9121C,000000FF,?,0000003F,?,?), ref: 00CFBC09
WideCharToMultiByte.KERNEL32(00000000,?,00D91270,000000FF,?,0000003F,?,?,?,00D9121C,000000FF,?,0000003F,?,?), ref: 00CFBC36

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 42712993c8fec7bd9eef23bca461aabca465e711d848b40495b8157da6bef019
Instruction ID: 9791200aba83af5db09195479036dbd2c63b2f3eb9d16276452657ff11999d52
Opcode Fuzzy Hash: 42712993c8fec7bd9eef23bca461aabca465e711d848b40495b8157da6bef019
Instruction Fuzzy Hash: 7E31AE7490430ADFCB51EF69DC8197ABBB8BF4575071442AAE260DB3A1D7309E00DB65

Function 00D3CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00D3CE89
GetLastError.KERNEL32(?,00000000), ref: 00D3CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00D3CEFE

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 07ad17ff27be8cce98a8faaf5b30e2ed745d550fb1c899becb05d499fa7b1d4e
Instruction ID: e3fb9926787554108fc3329acf05aba7f55a02299b39519aa55027179b6777df
Opcode Fuzzy Hash: 07ad17ff27be8cce98a8faaf5b30e2ed745d550fb1c899becb05d499fa7b1d4e
Instruction Fuzzy Hash: 7D21A9B1510305AFEB209FA5C948BAAB7F8EF00358F14541AE946E2251E770EE048B64

Function 00D28298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00D282AA

Strings

|, xrefs: 00D282DA
(, xrefs: 00D282F0

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 87586a75c1d3c34091717047ad2ba526c38d8919c0c024851c627e441ce45430
Instruction ID: 2a4bbedc64a639e0f609478473cd19256354e5cf1eb35b8e78b0e714f4da00dd
Opcode Fuzzy Hash: 87586a75c1d3c34091717047ad2ba526c38d8919c0c024851c627e441ce45430
Instruction Fuzzy Hash: A6324474A007159FCB28CF59D080A6AB7F0FF58724B15C46EE49ADB7A1EB70E941CB60

Function 00D35C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00D35CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00D35D17
FindClose.KERNEL32(?), ref: 00D35D5F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 1bc87b70e6c7f77a4b513f7b6055ed419315a92cdd4ceed47ba5a30ff0531f31
Instruction ID: 1ace68bb5f75bd0a290e87d1fe5c9e45de7cc6a294cf804b8f50dc29fb3e2d95
Opcode Fuzzy Hash: 1bc87b70e6c7f77a4b513f7b6055ed419315a92cdd4ceed47ba5a30ff0531f31
Instruction Fuzzy Hash: B1518974604B019FC714DF28E494E9AB7E4FF49324F18855EE99A8B3A1CB30ED45CBA1

Function 00CF2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00CF271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00CF2724
UnhandledExceptionFilter.KERNEL32(?), ref: 00CF2731

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: abfef80730f9c43c8592c639457cddec1c291f1d0cb7ac51a73dc023e2ae88e9
Instruction ID: 23578ba2c2b651d9a8d816ee38ba798823f9dc195cbaf35afdd5af022f9e6af0
Opcode Fuzzy Hash: abfef80730f9c43c8592c639457cddec1c291f1d0cb7ac51a73dc023e2ae88e9
Instruction Fuzzy Hash: 2A31D37491131CABCB21DF69DC8879CBBB8AF08310F5041EAE81CA7260E7709F819F55

Function 00D351CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D351DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00D35238
SetErrorMode.KERNEL32(00000000), ref: 00D352A1

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 1c36abf4d914447c1be58ca406e90ed722e92a23a94c9d9e76acd22307b15f74
Instruction ID: 8908b348b59e7e8b9f72c3ca281f11d49b9fe346f274ddd3410325d314e6e8cc
Opcode Fuzzy Hash: 1c36abf4d914447c1be58ca406e90ed722e92a23a94c9d9e76acd22307b15f74
Instruction Fuzzy Hash: C7313075A10618DFDB00DF54D884FAEBBB5FF49314F088099E8059B356DB31E856CBA0

Function 00D216C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00CDFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00CE0668
Part of subcall function 00CDFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00CE0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D2170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D2173A
GetLastError.KERNEL32 ref: 00D2174A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 765a2d3c79e73eeaff844fda5301a96f9dd0fc37ff8db18f87483a630447813d
Instruction ID: 5094fd5ce429d7d7c7fdca0d51abc3ccde159ed863d3ddff7efb0dec62b161f3
Opcode Fuzzy Hash: 765a2d3c79e73eeaff844fda5301a96f9dd0fc37ff8db18f87483a630447813d
Instruction Fuzzy Hash: EA1191B2414304AFD7189F54EC86D6BB7B9FB44765B24C52EE45697241EB70FC418A30

Function 00D2D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00D2D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00D2D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00D2D650

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 047f6b107a164fd28f73ec9c757a68d386e321adbe90607f517f046573d13966
Instruction ID: 9a63c2ac9ac27450797d3eee98b9403ddfca0c41149961bea3d5c0cecb649332
Opcode Fuzzy Hash: 047f6b107a164fd28f73ec9c757a68d386e321adbe90607f517f046573d13966
Instruction Fuzzy Hash: 75113C75E05328BFDB108F95AC45FAFBBBCEB45B51F108115F914E7290D6704A058BA1

Function 00D21663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00D2168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00D216A1
FreeSid.ADVAPI32(?), ref: 00D216B1

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 7a54f9576635ee5f4583b55591c0f58b2b2184b8e99e857638f44ade0513f29f
Instruction ID: 4545901ef7bc0200b4b726c26f27ea92db21820011415234f6ba9a0931477fd0
Opcode Fuzzy Hash: 7a54f9576635ee5f4583b55591c0f58b2b2184b8e99e857638f44ade0513f29f
Instruction Fuzzy Hash: 07F0F475950309FFDB00DFE49C89AAEBBBCEB08605F504565E901E2281E774AA448A60

Function 00CE4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00CF28E9,?,00CE4CBE,00CF28E9,00D888B8,0000000C,00CE4E15,00CF28E9,00000002,00000000,?,00CF28E9), ref: 00CE4D09
TerminateProcess.KERNEL32(00000000,?,00CE4CBE,00CF28E9,00D888B8,0000000C,00CE4E15,00CF28E9,00000002,00000000,?,00CF28E9), ref: 00CE4D10
ExitProcess.KERNEL32 ref: 00CE4D22

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 16852e8a5ff0b881e8dbf3e25dd75faf3cb439fe5d8e166b1886a3abe8d6029d
Instruction ID: 81d9e1e0e7aaa3ff4a5ff49c57e22c0db9569ad28c615d05c347df6a6a3189fa
Opcode Fuzzy Hash: 16852e8a5ff0b881e8dbf3e25dd75faf3cb439fe5d8e166b1886a3abe8d6029d
Instruction Fuzzy Hash: 05E0B672010788AFDF15AF55DD09A583F69FF81782B104054FD15CA223CB35DE42DA90

Function 00D1D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00D1D28C

Strings

X64, xrefs: 00D1D2A8

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 0c9f77e9bb062aa97302db35884b09ea62ec8e592fd40cc2d777412b6aab2cbb
Instruction ID: 382d52c2a5e2b92b70057489ff9998ee4b482c37ea782f933dd8814496d5af02
Opcode Fuzzy Hash: 0c9f77e9bb062aa97302db35884b09ea62ec8e592fd40cc2d777412b6aab2cbb
Instruction Fuzzy Hash: F4D0C9B481121DFECF90CB90ECC8DD9B3BCBB04305F100152F506E2140DB7495488F20

Function 00CECAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 61e24c011ace7863fbc849fae79ac03da6ffef2ddee203c8c156d6f3f7ac637c
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: D7020D71E012599FDF14CFA9C8C06ADFBF1EF48314F254169D929E7384D731AA428B94

Function 00D368EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00D36918
FindClose.KERNEL32(00000000), ref: 00D36961

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: fd43c6bc1051ff82fcd4491d5bcd1273ce58995f6af199d486cdc77f538d2b10
Instruction ID: ac49f297c5eda8b57b910ecd7d56ed223898028c1a70c2419ae3e60dd04c98b9
Opcode Fuzzy Hash: fd43c6bc1051ff82fcd4491d5bcd1273ce58995f6af199d486cdc77f538d2b10
Instruction Fuzzy Hash: 03118E31614200AFC710DF69D484B16BBE5EF85329F18C6ADE8698F7A2C730EC45CBA1

Function 00D337B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00D44891,?,?,00000035,?), ref: 00D337E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00D44891,?,?,00000035,?), ref: 00D337F4

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 56fe6ae3fe2f2df6ddbc76ec5639745deb52f8adbf89fe7326f3eb6679249221
Instruction ID: 5ff35c73903857ef1abdb1976d79cf2b7fcd4a8cf5b4d4d8fd47930425d38f09
Opcode Fuzzy Hash: 56fe6ae3fe2f2df6ddbc76ec5639745deb52f8adbf89fe7326f3eb6679249221
Instruction Fuzzy Hash: B3F0E5B17043292AE72017668C4DFEB3AAEEFC5761F000165F509D2291D9609904C7B0

Function 00D2B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00D2B25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00D2B270

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: c76c1bcb8108248c9457dcd369646a72ddef9340b8c2a01b7c64ce5b97076327
Instruction ID: e3258981639cacfa8848532b025ad7e488c6c4309e6327e39a51f1c2feddd3e7
Opcode Fuzzy Hash: c76c1bcb8108248c9457dcd369646a72ddef9340b8c2a01b7c64ce5b97076327
Instruction Fuzzy Hash: B4F01D7181434DAFDB059FA0D805BAE7FB4FF08319F04900AF955A5192D379C611DFA4

Function 00D210BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00D211FC), ref: 00D210D4
CloseHandle.KERNEL32(?,?,00D211FC), ref: 00D210E9

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 078758049a4c833271d0b91b6a7112f064834c9121b4099b993ec9e2a0acd57c
Instruction ID: 806fcc9489e11ecba0211b8006a18be5b81b8302c185719e160df51efb9a3dc8
Opcode Fuzzy Hash: 078758049a4c833271d0b91b6a7112f064834c9121b4099b993ec9e2a0acd57c
Instruction Fuzzy Hash: 24E04F32014710AEF7252B51FC05E7377A9FB04311B14882EF9A6805B1DB626C90EB60

Function 00CCCAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00D10C40

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 83bc4c73f260e293e3e94476ff74ebf586fff2c5e406aeaf63dafe78154fc27e
Instruction ID: f6f38183f609edeb524f378c29088fdfee6309282d9f67431852a9e2a4c49e19
Opcode Fuzzy Hash: 83bc4c73f260e293e3e94476ff74ebf586fff2c5e406aeaf63dafe78154fc27e
Instruction Fuzzy Hash: 1C327E70900218EBCF14EF94D985FEDBBB5BF05304F14405DE81AAB292DB75AE86DB60

Function 00CF676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00CF6766,?,?,00000008,?,?,00CFFEFE,00000000), ref: 00CF6998

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7d8dd696d65ac0e5aca64d02ff3cecb6ea4c7a01f815c97e4a73e1ffe73b9819
Instruction ID: d9ca4f116d04f5217d7570f8ef82ca5029749e22f34b07cd968681dec3f8e1d1
Opcode Fuzzy Hash: 7d8dd696d65ac0e5aca64d02ff3cecb6ea4c7a01f815c97e4a73e1ffe73b9819
Instruction Fuzzy Hash: 38B14B316106089FD759CF28C48AB657BE0FF45364F25865CE9AACF2E2C335EA91CB41

Function 00CDB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00D1851F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 545b3a62e866f39b06c33da2fe1c45fd911e9ff2bfc777200f08aeaf646ac12b
Instruction ID: f6dc4e54c3b2f0bda1027606650374816828a99cbd3579ea40bf926467714485
Opcode Fuzzy Hash: 545b3a62e866f39b06c33da2fe1c45fd911e9ff2bfc777200f08aeaf646ac12b
Instruction Fuzzy Hash: 02125E71900229DBDB14CF59D880AEEB7B5FF48710F15819AE949EB351EB309E81DFA0

Function 00D3EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00D3EABD

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: d6af4fbd3225efa5e1082c9d632d00039199e58bfb2278b193d7e73e9e1d5e48
Instruction ID: 4a605cb3baee2e50f31294b383ad3fe6cdcecacd04b46bfee5a642ea73ed9c06
Opcode Fuzzy Hash: d6af4fbd3225efa5e1082c9d632d00039199e58bfb2278b193d7e73e9e1d5e48
Instruction Fuzzy Hash: A0E04F312103059FC710EF99D845E9AF7E9AF98760F00841AFC49C73A1DBB0EC418BA0

Function 00CE09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00CE03EE), ref: 00CE09DA

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a66d6bb39c2510fa4816d72fbeaa83600e4966bde54a9de2e3acecae6b392fcb
Instruction ID: 3fa51fe07e11cb03f60395116bc4200f4fe8b8def04d6e41eb95eefaf1faf44f
Opcode Fuzzy Hash: a66d6bb39c2510fa4816d72fbeaa83600e4966bde54a9de2e3acecae6b392fcb
Instruction Fuzzy Hash:

Function 00CE781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00CE798B

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 449a69e1ea7aeaaeb694e0da865e8a0631f69e5fdfeb55554f50d4e80152f290
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 2E51897160C7C55BDF38866B895E7BE27899F22340F180719E8A6EB2C3C619DF05E352

Function 00CF6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b030900edd92be6001a737094c6e7204679a4e91993539dc9c27ff0ef723543
Instruction ID: 81913bfb2a6229d4d2af6070b812540d560b59bb47045838f7e347452b80aa78
Opcode Fuzzy Hash: 5b030900edd92be6001a737094c6e7204679a4e91993539dc9c27ff0ef723543
Instruction Fuzzy Hash: 98325432D28F054DD7639634CC22335A649AFB73C4F14C737F82AB5AAAEB69C5834111

Function 00CDCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83551833aaf08e48e946aa17a47c77fafc297b7e825e06b9494c1db90c667433
Instruction ID: 2e4600696552c47e766ede02f055271758eb2b453f5cdea9c1a164b96e00a2a0
Opcode Fuzzy Hash: 83551833aaf08e48e946aa17a47c77fafc297b7e825e06b9494c1db90c667433
Instruction Fuzzy Hash: D8322731AA4116ABCF24CB28E5D06FD77A1EF85300F28A567D699C7391DA30DDC1DB60

Function 00CC7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692846326f6f81d31ce885271f8047a9249e525124760a9714fbd60dbc073f35
Instruction ID: 010180fdb89b08bd84fa111b71c911ef6b061276a92bb369959de813c5f3b05c
Opcode Fuzzy Hash: 692846326f6f81d31ce885271f8047a9249e525124760a9714fbd60dbc073f35
Instruction Fuzzy Hash: 5522AF70A0060A9FDF14CFA5D881BAEB7F5FF44300F244629E816A7295EB369E51DF60

Function 00CC91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f375a09d6625b94e6f8bb7d32717d8578df190fbc19af4c8616b0a6c547e471d
Instruction ID: e1a9eb0b46e954809eb784545ce39ccf7591d572947a3bad38bff1c6a613c1e4
Opcode Fuzzy Hash: f375a09d6625b94e6f8bb7d32717d8578df190fbc19af4c8616b0a6c547e471d
Instruction Fuzzy Hash: 4B02B6B0E00205EBDB04DF54D881BAEB7B1FF44300F148569E85ADB391EB31EA51DBA5

Function 00CF9EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d69a79ab3ceef5e75fec519d2829cce92f5b3e14be2a20853bf69d6e4426ab0
Instruction ID: 26e4b9050e0ae64e88c1bf6868d0328167f1126a164cd2db449942d05379f68b
Opcode Fuzzy Hash: 9d69a79ab3ceef5e75fec519d2829cce92f5b3e14be2a20853bf69d6e4426ab0
Instruction Fuzzy Hash: 61B1F320D2AF414DD32396398831336B65CAFBB6D5F91D71BFC1AB4E62EB2186834151

Function 00CE1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: d001ff0453b2d345a6739246046c3086321562cec2ebedf23817b412a2db687d
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: B89124726090E34ADB2A463B857447DFEE15A523A131E079DECF2CB1C5EE349B74D620

Function 00CE1F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 6dec713ec4672d56ea7571718b26ae97346eab86accb739e031a2515f502616f
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: E79165732090E349DB69467B847413EFFE55A923A131E079ED8F2CB1C5EE248B64E620

Function 00CE19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: ec060cb1c6dfeeb5dded8b2ecc56b17ec584e72b2d970dafa9a371efd44fb851
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 819113722090E34ADB69467B857443DFFE15A923A231E07AED8F2CA1C5FD349674E620

Function 00CE7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562ae18d87041847eebda7302b89bb5e1afdb8462bec27161d32c2ac724a9715
Instruction ID: d8a01341996c1c65e5b720f8b4df18625d3cc1fb96ac6702106e04f112308474
Opcode Fuzzy Hash: 562ae18d87041847eebda7302b89bb5e1afdb8462bec27161d32c2ac724a9715
Instruction Fuzzy Hash: 5F6157716087C997DE349A2B8D95BBE3398DF41700F201B2EE863DB281DA119F46A356

Function 00CE7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a633ef4e5596c1dd7e20979354b5e3563c4a764b85d4f1b9436abfb3038d21fd
Instruction ID: 7748c9ce76161d3de06fa9da3f56f3c9be8c90f56e137e209b9265a156e14b53
Opcode Fuzzy Hash: a633ef4e5596c1dd7e20979354b5e3563c4a764b85d4f1b9436abfb3038d21fd
Instruction Fuzzy Hash: 06619D7160C7C96BDE388A2B4C96BBF3389EF42740F100B59E953DB281EA12DF469355

Function 00CE1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: af5218147935eb8657b0688657cd32f6179a855b37be2193872d55c2c56e451b
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 6B8153726090E34ADB6D463B857447EFFE15A923A131E079DD8F2CA1C2EE349774E620

Function 00D32046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a829466a962a97b9468ce5a3bfa974e4a892393faff5ee025b0a5f733be632e
Instruction ID: c1515f0501239a88848e59289fbc2961640872c9c9d49813e5d31ac3a1501121
Opcode Fuzzy Hash: 3a829466a962a97b9468ce5a3bfa974e4a892393faff5ee025b0a5f733be632e
Instruction Fuzzy Hash: B12193326216118BDB28CE79C82267E73E5AB54310F19862EE4A7C77D0DE35A904CBA0

Function 00D42ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00D42B30
DeleteObject.GDI32(00000000), ref: 00D42B43
DestroyWindow.USER32 ref: 00D42B52
GetDesktopWindow.USER32 ref: 00D42B6D
GetWindowRect.USER32(00000000), ref: 00D42B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00D42CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00D42CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D42CF8
GetClientRect.USER32(00000000,?), ref: 00D42D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00D42D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D42D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D42D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D42D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D42D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D42D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D42DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D42DA8
GlobalFree.KERNEL32(00000000), ref: 00D42DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D42DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00D5FC38,00000000), ref: 00D42DDB
GlobalFree.KERNEL32(00000000), ref: 00D42DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00D42E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00D42E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D42E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D4303F

Strings

, xrefs: 00D42FC5
static, xrefs: 00D42D3A, 00D42E91
AutoIt v3, xrefs: 00D42CF2
DISPLAY, xrefs: 00D42EA2

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: d7d727d5422a6663b82fa71c237cd6b07a7f5b1d6ab45df33e1fbf467de81ae2
Instruction ID: 75559b7021474b24280985ae9ee50c69bfc1b2eb0ea3bdb2ec6bceddf208e45f
Opcode Fuzzy Hash: d7d727d5422a6663b82fa71c237cd6b07a7f5b1d6ab45df33e1fbf467de81ae2
Instruction Fuzzy Hash: A5024775910309AFDB14DFA8CC89EAE7BB9EB48711F048158F915EB2A1DB70ED01CB60

Function 00D570D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00D5712F
GetSysColorBrush.USER32(0000000F), ref: 00D57160
GetSysColor.USER32(0000000F), ref: 00D5716C
SetBkColor.GDI32(?,000000FF), ref: 00D57186
SelectObject.GDI32(?,?), ref: 00D57195
InflateRect.USER32(?,000000FF,000000FF), ref: 00D571C0
GetSysColor.USER32(00000010), ref: 00D571C8
CreateSolidBrush.GDI32(00000000), ref: 00D571CF
FrameRect.USER32(?,?,00000000), ref: 00D571DE
DeleteObject.GDI32(00000000), ref: 00D571E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00D57230
FillRect.USER32(?,?,?), ref: 00D57262
GetWindowLongW.USER32(?,000000F0), ref: 00D57284

Part of subcall function 00D573E8: GetSysColor.USER32(00000012), ref: 00D57421
Part of subcall function 00D573E8: SetTextColor.GDI32(?,?), ref: 00D57425
Part of subcall function 00D573E8: GetSysColorBrush.USER32(0000000F), ref: 00D5743B
Part of subcall function 00D573E8: GetSysColor.USER32(0000000F), ref: 00D57446
Part of subcall function 00D573E8: GetSysColor.USER32(00000011), ref: 00D57463
Part of subcall function 00D573E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D57471
Part of subcall function 00D573E8: SelectObject.GDI32(?,00000000), ref: 00D57482
Part of subcall function 00D573E8: SetBkColor.GDI32(?,00000000), ref: 00D5748B
Part of subcall function 00D573E8: SelectObject.GDI32(?,?), ref: 00D57498
Part of subcall function 00D573E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00D574B7
Part of subcall function 00D573E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D574CE
Part of subcall function 00D573E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00D574DB

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: cf6e344af099a47fbde92506cf45f6b8f90786422b0e03ff125592168a03ef86
Instruction ID: 38f08ec8dedc33c73bdde9c574f19c4561f305938d50ebac95e64bccc299c5b7
Opcode Fuzzy Hash: cf6e344af099a47fbde92506cf45f6b8f90786422b0e03ff125592168a03ef86
Instruction Fuzzy Hash: EDA1A072018701BFDB009F64DC48E5BBBA9FB49322F241A19FDA2D62E1D771E944CB61

Function 00CD8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00CD8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00D16AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00D16AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00D16F43

Part of subcall function 00CD8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00CD8BE8,?,00000000,?,?,?,?,00CD8BBA,00000000,?), ref: 00CD8FC5

SendMessageW.USER32(?,00001053), ref: 00D16F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00D16F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00D16FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00D16FB7

Strings

0, xrefs: 00D16DCF

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 2978bec07c3eb82c8578903678982984c05cdba7772e85aee34f912d869d1b4f
Instruction ID: 70c2631425ceacb7429d6d644846bd2e2ed4f1da16307bab97037f291f8abce8
Opcode Fuzzy Hash: 2978bec07c3eb82c8578903678982984c05cdba7772e85aee34f912d869d1b4f
Instruction Fuzzy Hash: 3B129C38204301EFDB25CF24E984BA5BBA5FB44301F18856AF595CB661CB31EC96DFA1

Function 00D42711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00D4273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00D4286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00D428A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00D428B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00D42900
GetClientRect.USER32(00000000,?), ref: 00D4290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00D42955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00D42964
GetStockObject.GDI32(00000011), ref: 00D42974
SelectObject.GDI32(00000000,00000000), ref: 00D42978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00D42988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D42991
DeleteDC.GDI32(00000000), ref: 00D4299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00D429C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00D429DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00D42A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00D42A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00D42A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00D42A77
GetStockObject.GDI32(00000011), ref: 00D42A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00D42A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00D42A97

Strings

msctls_progress32, xrefs: 00D42A13
static, xrefs: 00D4294F, 00D42A71
AutoIt v3, xrefs: 00D428F8
DISPLAY, xrefs: 00D4295A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 2db6bfc9400c0a5d210c1caaa31fd85390dd531884d7b937375293861bb4778d
Instruction ID: 83a01382d46cb446d4c20674f7296fadadf38510c7b21dfa6dc11f5219e2528e
Opcode Fuzzy Hash: 2db6bfc9400c0a5d210c1caaa31fd85390dd531884d7b937375293861bb4778d
Instruction Fuzzy Hash: DCB12A75A10315AFEB14DFA8CC8AFAE7BB9EB08711F004219F915E7290D770AD40CBA0

Function 00D34ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D34AED
GetDriveTypeW.KERNEL32(?,00D5CB68,?,\\.\,00D5CC08), ref: 00D34BCA
SetErrorMode.KERNEL32(00000000,00D5CB68,?,\\.\,00D5CC08), ref: 00D34D36

Strings

1394, xrefs: 00D34C9F
RAID, xrefs: 00D34CBB
CDROM, xrefs: 00D34BFB
Fixed, xrefs: 00D34C09
SSA, xrefs: 00D34CA6
SATA, xrefs: 00D34CD0
Network, xrefs: 00D34C02
USB, xrefs: 00D34CB4
ATAPI, xrefs: 00D34C91
Removable, xrefs: 00D34C10, 00D34C15
SAS, xrefs: 00D34CC9
PhysicalDrive, xrefs: 00D34B76
SSD, xrefs: 00D34C4A
\\.\, xrefs: 00D34B3F
MMC, xrefs: 00D34CDE
SCSI, xrefs: 00D34C8A
RAMDisk, xrefs: 00D34BF4
Unknown, xrefs: 00D34BED, 00D34C83
ATA, xrefs: 00D34C98
FileBackedVirtual, xrefs: 00D34CEC
Fibre, xrefs: 00D34CAD
iSCSI, xrefs: 00D34CC2
Virtual, xrefs: 00D34CE5

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 336d7c6359ad12368f44480c5f60d63c60aaa52446b6e17133c42dcb8831404d
Instruction ID: 92647127fb7b108818906c8fe0d4b80bf1aca7f7788d616927bbbb2353dfe846
Opcode Fuzzy Hash: 336d7c6359ad12368f44480c5f60d63c60aaa52446b6e17133c42dcb8831404d
Instruction Fuzzy Hash: 1061BF316052059FCB04EF24CA82E6DB7A1EF04754F289019F846AB392DB39FD45EB71

Function 00D573E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00D57421
SetTextColor.GDI32(?,?), ref: 00D57425
GetSysColorBrush.USER32(0000000F), ref: 00D5743B
GetSysColor.USER32(0000000F), ref: 00D57446
CreateSolidBrush.GDI32(?), ref: 00D5744B
GetSysColor.USER32(00000011), ref: 00D57463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D57471
SelectObject.GDI32(?,00000000), ref: 00D57482
SetBkColor.GDI32(?,00000000), ref: 00D5748B
SelectObject.GDI32(?,?), ref: 00D57498
InflateRect.USER32(?,000000FF,000000FF), ref: 00D574B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D574CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00D574DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00D5752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00D57554
InflateRect.USER32(?,000000FD,000000FD), ref: 00D57572
DrawFocusRect.USER32(?,?), ref: 00D5757D
GetSysColor.USER32(00000011), ref: 00D5758E
SetTextColor.GDI32(?,00000000), ref: 00D57596
DrawTextW.USER32(?,00D570F5,000000FF,?,00000000), ref: 00D575A8
SelectObject.GDI32(?,?), ref: 00D575BF
DeleteObject.GDI32(?), ref: 00D575CA
SelectObject.GDI32(?,?), ref: 00D575D0
DeleteObject.GDI32(?), ref: 00D575D5
SetTextColor.GDI32(?,?), ref: 00D575DB
SetBkColor.GDI32(?,?), ref: 00D575E5

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 3a1054f313ad0ca412f70803721e345d10ce9d8a83ed9cad091d8e2978e75778
Instruction ID: d19ac0b9976d7f6f01483fb52cc298dc135b3680da6ce2c6e15fcb73c3c95c2b
Opcode Fuzzy Hash: 3a1054f313ad0ca412f70803721e345d10ce9d8a83ed9cad091d8e2978e75778
Instruction Fuzzy Hash: E6614B72900318AFDF019FA4DC49EAEBFB9EB08322F255115FD15EB2A1D7749940CBA0

Function 00D50FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00D51128
GetDesktopWindow.USER32 ref: 00D5113D
GetWindowRect.USER32(00000000), ref: 00D51144
GetWindowLongW.USER32(?,000000F0), ref: 00D51199
DestroyWindow.USER32(?), ref: 00D511B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00D511ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D5120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00D5121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00D51232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00D51245
IsWindowVisible.USER32(00000000), ref: 00D512A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00D512BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00D512D0
GetWindowRect.USER32(00000000,?), ref: 00D512E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00D5130E
GetMonitorInfoW.USER32(00000000,?), ref: 00D51328
CopyRect.USER32(?,?), ref: 00D5133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00D513AA

Strings

(, xrefs: 00D5131B
tooltips_class32, xrefs: 00D511E6
0, xrefs: 00D510D3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 7f6fed60e441fc62a79731e296a89ef08ce2adda49468aa0e7018388f2c83d5c
Instruction ID: 83daf9de8e303720d834027f3cffcbf0da2943edc43c6932bf07705c1c323fb4
Opcode Fuzzy Hash: 7f6fed60e441fc62a79731e296a89ef08ce2adda49468aa0e7018388f2c83d5c
Instruction Fuzzy Hash: 4DB16975604341AFDB10DF64C885F6ABBE4EF84351F04891CFD999B2A1DB71E848CBA1

Function 00CD8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00CD8968
GetSystemMetrics.USER32(00000007), ref: 00CD8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00CD899B
GetSystemMetrics.USER32(00000008), ref: 00CD89A3
GetSystemMetrics.USER32(00000004), ref: 00CD89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00CD89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00CD89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00CD8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00CD8A3C
GetClientRect.USER32(00000000,000000FF), ref: 00CD8A5A
GetStockObject.GDI32(00000011), ref: 00CD8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00CD8A81

Part of subcall function 00CD912D: GetCursorPos.USER32(?), ref: 00CD9141
Part of subcall function 00CD912D: ScreenToClient.USER32(00000000,?), ref: 00CD915E
Part of subcall function 00CD912D: GetAsyncKeyState.USER32(00000001), ref: 00CD9183
Part of subcall function 00CD912D: GetAsyncKeyState.USER32(00000002), ref: 00CD919D

SetTimer.USER32(00000000,00000000,00000028,00CD90FC), ref: 00CD8AA8

Strings

AutoIt v3 GUI, xrefs: 00CD8A20

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 37a1041e7c4688dd70c753d63295bfc953b4eebc99dd4961269df6d894360bad
Instruction ID: 1e601c549625ad09f1a5bc9126f9e2b1bd455065769ab1eaa1456a5b8e93262b
Opcode Fuzzy Hash: 37a1041e7c4688dd70c753d63295bfc953b4eebc99dd4961269df6d894360bad
Instruction Fuzzy Hash: 8CB15B75A0030AAFDB14DFA8DC85BAA3BB5FB48315F14421AFA15E7390DB30E941CB60

Function 00D20D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00D21114
Part of subcall function 00D210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00D20B9B,?,?,?), ref: 00D21120
Part of subcall function 00D210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00D20B9B,?,?,?), ref: 00D2112F
Part of subcall function 00D210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00D20B9B,?,?,?), ref: 00D21136
Part of subcall function 00D210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00D2114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00D20DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00D20E29
GetLengthSid.ADVAPI32(?), ref: 00D20E40
GetAce.ADVAPI32(?,00000000,?), ref: 00D20E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00D20E96
GetLengthSid.ADVAPI32(?), ref: 00D20EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00D20EB5
HeapAlloc.KERNEL32(00000000), ref: 00D20EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00D20EDD
CopySid.ADVAPI32(00000000), ref: 00D20EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00D20F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00D20F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00D20F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D20F6E
HeapFree.KERNEL32(00000000), ref: 00D20F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D20F7E
HeapFree.KERNEL32(00000000), ref: 00D20F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D20F8E
HeapFree.KERNEL32(00000000), ref: 00D20F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00D20FA1
HeapFree.KERNEL32(00000000), ref: 00D20FA8

Part of subcall function 00D21193: GetProcessHeap.KERNEL32(00000008,00D20BB1,?,00000000,?,00D20BB1,?), ref: 00D211A1
Part of subcall function 00D21193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00D20BB1,?), ref: 00D211A8
Part of subcall function 00D21193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00D20BB1,?), ref: 00D211B7

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: bc89decd7b900c36b68a0c229511f52774f953dc337e93e8d456c6a306df3875
Instruction ID: c771225d774c2383c06e9ef9ed058e1e95d1c8b490cbc2fbd7fbc4d0df4315a3
Opcode Fuzzy Hash: bc89decd7b900c36b68a0c229511f52774f953dc337e93e8d456c6a306df3875
Instruction Fuzzy Hash: 0E715A7290431AAFDF209FA4ED44FAEBBB8EF14315F084115F919E6292DB319905CB70

Function 00D4C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D4C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00D5CC08,00000000,?,00000000,?,?), ref: 00D4C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00D4C5A4
_wcslen.LIBCMT ref: 00D4C5F4
_wcslen.LIBCMT ref: 00D4C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00D4C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00D4C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00D4C84D
RegCloseKey.ADVAPI32(?), ref: 00D4C881
RegCloseKey.ADVAPI32(00000000), ref: 00D4C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00D4C960

Strings

REG_SZ, xrefs: 00D4C644
REG_BINARY, xrefs: 00D4C913
REG_DWORD, xrefs: 00D4C804
REG_MULTI_SZ, xrefs: 00D4C6F5
REG_QWORD, xrefs: 00D4C8C3
REG_EXPAND_SZ, xrefs: 00D4C5CD

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: bc493495d830eecfc139fb9527d481e31a7c9bf427df24b37a7204fc7e0953ce
Instruction ID: 9c42188329d38d64402db02347004cf4b7ca878dc191da4126e24cd70e959762
Opcode Fuzzy Hash: bc493495d830eecfc139fb9527d481e31a7c9bf427df24b37a7204fc7e0953ce
Instruction Fuzzy Hash: 141247356142019FDB54DF14C881F2AB7E5EF88714F18899CF88A9B3A2DB31ED41DB91

Function 00D5091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00D509C6
_wcslen.LIBCMT ref: 00D50A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00D50A54
_wcslen.LIBCMT ref: 00D50A8A
_wcslen.LIBCMT ref: 00D50B06
_wcslen.LIBCMT ref: 00D50B81

Part of subcall function 00CDF9F2: _wcslen.LIBCMT ref: 00CDF9FD

Part of subcall function 00D22BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D22BFA

Strings

GETTOTALCOUNT, xrefs: 00D509F2, 00D50A17
GETSELECTED, xrefs: 00D50C4E
EXISTS, xrefs: 00D50B7C, 00D50B97
ISCHECKED, xrefs: 00D50CE1
EXPAND, xrefs: 00D50BF8
COLLAPSE, xrefs: 00D50B01, 00D50B1C
SELECT, xrefs: 00D50D11
GETITEMCOUNT, xrefs: 00D50C1E
UNCHECK, xrefs: 00D50D3E
GETTEXT, xrefs: 00D50C97
CHECK, xrefs: 00D50A85, 00D50AA0

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 69964c22a84be4a50a11e4024f01c6eb40f53484cda33e2b7e3bd66bdca94b1d
Instruction ID: 3da26e899354f178e23f28db1d8b2dacbffc37831b9be5dd3475cade9e75d54e
Opcode Fuzzy Hash: 69964c22a84be4a50a11e4024f01c6eb40f53484cda33e2b7e3bd66bdca94b1d
Instruction Fuzzy Hash: D5E18D316083019FCB14EF24C49092ABBE1FF98315B18895DFC969B762DB31ED49DBA1

Function 00D4C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D4B6AE,?,?), ref: 00D4C9B5
_wcslen.LIBCMT ref: 00D4C9F1
_wcslen.LIBCMT ref: 00D4CA68
_wcslen.LIBCMT ref: 00D4CA9E
_wcslen.LIBCMT ref: 00D4CAF9
_wcslen.LIBCMT ref: 00D4CB2F
_wcslen.LIBCMT ref: 00D4CB7F

Strings

HKEY_CURRENT_CONFIG, xrefs: 00D4CB79, 00D4CB7E
HKCR, xrefs: 00D4CB29, 00D4CB2E
HKCU, xrefs: 00D4CBCE
HKEY_CURRENT_USER, xrefs: 00D4CBBD
HKU, xrefs: 00D4CBF0
HKEY_USERS, xrefs: 00D4CBDF
HKEY_LOCAL_MACHINE, xrefs: 00D4CA62, 00D4CA67
HKLM, xrefs: 00D4CA98, 00D4CA9D
HKCC, xrefs: 00D4CBAC
HKEY_CLASSES_ROOT, xrefs: 00D4CAF3, 00D4CAF8

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 795fd935c9432375a3c1b4160cc9255ec43ca954f5f67b98b05557458ce31284
Instruction ID: bd11a308c3ff47965a4ab43d4ead06240068ae25c3e6af18b96d8ae286ae1d2a
Opcode Fuzzy Hash: 795fd935c9432375a3c1b4160cc9255ec43ca954f5f67b98b05557458ce31284
Instruction Fuzzy Hash: 8571253262112A8BCB60DE7CCC426BE3391AF60754F292528FC66A7384EA31CD45D7B0

Function 00D5833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D5835A
_wcslen.LIBCMT ref: 00D5836E
_wcslen.LIBCMT ref: 00D58391
_wcslen.LIBCMT ref: 00D583B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00D583F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00D5361A,?), ref: 00D5844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00D58487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00D584CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00D58501
FreeLibrary.KERNEL32(?), ref: 00D5850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00D5851D
DestroyIcon.USER32(?), ref: 00D5852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00D58549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00D58555

Strings

.dll, xrefs: 00D583AB
.exe, xrefs: 00D58388
.icl, xrefs: 00D58368

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 978a6a75ffdfeac064af5880e6d08e9321e32cccd109ef8b5af91f935edd85a1
Instruction ID: 3a70eaf3ebc77edfff3258e30af8e13cbcf24d9afa0cb45671652283f6c2e0d4
Opcode Fuzzy Hash: 978a6a75ffdfeac064af5880e6d08e9321e32cccd109ef8b5af91f935edd85a1
Instruction Fuzzy Hash: EE619D71900315BEEF149F64CC81BBE77A8AB08722F104609FD15E61D1EB74AA84EBB0

Function 00CC7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#comments-start, xrefs: 00CC785F, 00CC78B1
Cannot parse #include, xrefs: 00D05279
#include, xrefs: 00CC7847
", xrefs: 00D05153
#requireadmin, xrefs: 00CC77FF
#ce, xrefs: 00CC78ED
#comments-end, xrefs: 00CC78D9
#notrayicon, xrefs: 00CC77E7
#OnAutoItStartRegister, xrefs: 00CC7817
', xrefs: 00D05169
Unterminated group of comments, xrefs: 00D0528C
#include-once, xrefs: 00CC782F
#cs, xrefs: 00CC7873, 00CC78C5
Bad directive syntax error, xrefs: 00D0519A
#pragma compile, xrefs: 00CC77D3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 0d4611055954dd756d87fc0ec9e0503f75140b110d917c4b1f1b7d68d85df835
Instruction ID: 1132142fa26f509feb0e12703ba7e713eb75ec17fb15bd2180397cba0e5bcb61
Opcode Fuzzy Hash: 0d4611055954dd756d87fc0ec9e0503f75140b110d917c4b1f1b7d68d85df835
Instruction Fuzzy Hash: 3B81D271604205BBDF21AF61DD42FAF37A8EF15300F044129FD09AB196EB70DA59DBA1

Function 00D33E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00D33EF8
_wcslen.LIBCMT ref: 00D33F03
_wcslen.LIBCMT ref: 00D33F5A
_wcslen.LIBCMT ref: 00D33F98
GetDriveTypeW.KERNEL32(?), ref: 00D33FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D3401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D34059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D34087

Strings

close, xrefs: 00D33EFE, 00D33F18
set cd door , xrefs: 00D34028
type cdaudio alias cd wait, xrefs: 00D34001
wait, xrefs: 00D34044
closed, xrefs: 00D33F08, 00D33F2D, 00D33F46, 00D33F7E, 00D33F97
open , xrefs: 00D33FE5
open, xrefs: 00D33F54, 00D33F59
close cd wait, xrefs: 00D34072

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 0fd5ce831b5a0712c0750fdb9cb52737a0065bdc40ad65c1512e240b2190242e
Instruction ID: 1a1d42354175b98b4b83e98c2ec2b09ff89982879ace960fb7b5366717990024
Opcode Fuzzy Hash: 0fd5ce831b5a0712c0750fdb9cb52737a0065bdc40ad65c1512e240b2190242e
Instruction Fuzzy Hash: 4B71D232A043019FC310EF24C98196AB7F4EF94768F54492DF896972A1EB34ED49DBA1

Function 00D25A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00D25A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00D25A40
SetWindowTextW.USER32(?,?), ref: 00D25A57
GetDlgItem.USER32(?,000003EA), ref: 00D25A6C
SetWindowTextW.USER32(00000000,?), ref: 00D25A72
GetDlgItem.USER32(?,000003E9), ref: 00D25A82
SetWindowTextW.USER32(00000000,?), ref: 00D25A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00D25AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00D25AC3
GetWindowRect.USER32(?,?), ref: 00D25ACC
_wcslen.LIBCMT ref: 00D25B33
SetWindowTextW.USER32(?,?), ref: 00D25B6F
GetDesktopWindow.USER32 ref: 00D25B75
GetWindowRect.USER32(00000000), ref: 00D25B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00D25BD3
GetClientRect.USER32(?,?), ref: 00D25BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00D25C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00D25C2F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 98c4ce7af0d72940c809e697b976c332cae6e705a2836290045c4f901de74161
Instruction ID: 10ba92fb28b087fc06dc5a3cd700ecfb02c9cafb23ab1a34fdfb3abb42cdcce8
Opcode Fuzzy Hash: 98c4ce7af0d72940c809e697b976c332cae6e705a2836290045c4f901de74161
Instruction Fuzzy Hash: 29717D31900B15AFDB20DFA8EE85F6EBBF5FF58709F144518E582A26A4D771E940CB20

Function 00D3FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00D3FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 00D3FE32
LoadCursorW.USER32(00000000,00007F00), ref: 00D3FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 00D3FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 00D3FE53
LoadCursorW.USER32(00000000,00007F01), ref: 00D3FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 00D3FE69
LoadCursorW.USER32(00000000,00007F88), ref: 00D3FE74
LoadCursorW.USER32(00000000,00007F80), ref: 00D3FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 00D3FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 00D3FE95
LoadCursorW.USER32(00000000,00007F85), ref: 00D3FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 00D3FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 00D3FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 00D3FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 00D3FECC
GetCursorInfo.USER32(?), ref: 00D3FEDC
GetLastError.KERNEL32 ref: 00D3FF1E

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 3309302e06ba2e2c928be2635b8757eae34ac2e56615f01e878213a1bf6c4939
Instruction ID: cec2589ab6c6a0614a367fe3c42ca088fec99d9ea879a943ede3331ec6f8656f
Opcode Fuzzy Hash: 3309302e06ba2e2c928be2635b8757eae34ac2e56615f01e878213a1bf6c4939
Instruction Fuzzy Hash: FB4172B0D083196ADB109FBA8C89C5EBFE8FF04754B54452AE51DE7281DB78E901CFA0

Function 00CE00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00CE00C6

Part of subcall function 00CE00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00D9070C,00000FA0,5C4B0962,?,?,?,?,00D023B3,000000FF), ref: 00CE011C
Part of subcall function 00CE00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00D023B3,000000FF), ref: 00CE0127
Part of subcall function 00CE00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00D023B3,000000FF), ref: 00CE0138
Part of subcall function 00CE00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00CE014E
Part of subcall function 00CE00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00CE015C
Part of subcall function 00CE00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00CE016A
Part of subcall function 00CE00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00CE0195
Part of subcall function 00CE00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00CE01A0

___scrt_fastfail.LIBCMT ref: 00CE00E7

Part of subcall function 00CE00A3: __onexit.LIBCMT ref: 00CE00A9

Strings

SleepConditionVariableCS, xrefs: 00CE0154
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00CE0122
WakeAllConditionVariable, xrefs: 00CE0162
InitializeConditionVariable, xrefs: 00CE0148
kernel32.dll, xrefs: 00CE0133

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: cf0bb00f3d72eb8347f3715906a3f2e4333bebbf9d2e3e19e54a19cf5ae3dc09
Instruction ID: f9cac76d346ad5cc4ca9dbe6c511be2b1afc1e3f046fc83583ed62b79009011a
Opcode Fuzzy Hash: cf0bb00f3d72eb8347f3715906a3f2e4333bebbf9d2e3e19e54a19cf5ae3dc09
Instruction Fuzzy Hash: DE21A7326557506FEB115BA5AC06F6E37A4EB05B62F20012BFD01EA791DAA498448AF0

Function 00D230F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D2318D
_wcslen.LIBCMT ref: 00D231F8

Strings

CLASS, xrefs: 00D23188, 00D231A5
INSTANCE, xrefs: 00D23453
CLASSNN, xrefs: 00D231F3, 00D23204
TEXT, xrefs: 00D2347C
REGEXPCLASS, xrefs: 00D23255, 00D23266
NAME, xrefs: 00D23335, 00D23346

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 6981e7337222a5a9f60ede9f8275bdd34810044f10779a15d7edf788fd6ee2e3
Instruction ID: b0034fa752e5021960cd7615210aa22c52fb0ece958d502b76e703cd6ca9a40c
Opcode Fuzzy Hash: 6981e7337222a5a9f60ede9f8275bdd34810044f10779a15d7edf788fd6ee2e3
Instruction Fuzzy Hash: 82E10831A00626ABCB18DF78D451BEDBBB4BF24718F588119E456B7240DB34AF8597B0

Function 00D344C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00D5CC08), ref: 00D34527
_wcslen.LIBCMT ref: 00D3453B
_wcslen.LIBCMT ref: 00D34599
_wcslen.LIBCMT ref: 00D345F4
_wcslen.LIBCMT ref: 00D3463F
_wcslen.LIBCMT ref: 00D346A7

Part of subcall function 00CDF9F2: _wcslen.LIBCMT ref: 00CDF9FD

GetDriveTypeW.KERNEL32(?,00D86BF0,00000061), ref: 00D34743

Strings

network, xrefs: 00D3469D, 00D346A2
all, xrefs: 00D34531, 00D34536
removable, xrefs: 00D345EA, 00D345EF
cdrom, xrefs: 00D3458F, 00D34594
unknown, xrefs: 00D34708
fixed, xrefs: 00D34635, 00D3463A
ramdisk, xrefs: 00D346F1

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: d87352ca76d0b1ac01a8c758b09bd0e1a1e7cf48bb17fbda54ee9bda77d56c0d
Instruction ID: 85346eabf154bdf9f1936cf71cafeeea08f0f3c003226dba526bfeaaf67411f1
Opcode Fuzzy Hash: d87352ca76d0b1ac01a8c758b09bd0e1a1e7cf48bb17fbda54ee9bda77d56c0d
Instruction Fuzzy Hash: 18B1F071A083029FC710DF28C891AAAB7E5EFA5764F54891DF496C7291D738E844CBB2

Function 00D43FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00D5CC08), ref: 00D440BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00D440CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00D5CC08), ref: 00D440F2
FreeLibrary.KERNEL32(00000000,?,00D5CC08), ref: 00D4413E
StringFromGUID2.OLE32(?,?,00000028,?,00D5CC08), ref: 00D441A8
SysFreeString.OLEAUT32(00000009), ref: 00D44262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00D442C8
SysFreeString.OLEAUT32(?), ref: 00D442F2

Strings

GetModuleHandleExW, xrefs: 00D440C7
kernel32.dll, xrefs: 00D440B6

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: 119df6ee5e047951e5841a2cd303b560b8c8b04e89b5f77405602a9db8568742
Instruction ID: 56670375273864019ca1df6c884bc914f86e9ea27d2f71b294f381a1b91d448b
Opcode Fuzzy Hash: 119df6ee5e047951e5841a2cd303b560b8c8b04e89b5f77405602a9db8568742
Instruction Fuzzy Hash: 2A123B75A00215EFDB14CF94C884FAEBBB5FF45315F288098E909AB251D771ED86CBA0

Function 00CC326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00D91990), ref: 00D02F8D
GetMenuItemCount.USER32(00D91990), ref: 00D0303D
GetCursorPos.USER32(?), ref: 00D03081
SetForegroundWindow.USER32(00000000), ref: 00D0308A
TrackPopupMenuEx.USER32(00D91990,00000000,?,00000000,00000000,00000000), ref: 00D0309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00D030A9

Strings

0, xrefs: 00CC327D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 72ec9215a177064e21c2d5a0a6f447d1c9ee7af3bfcf97e5d20168f13ed5ee57
Instruction ID: 0ba47e3e3643922f7cc4a21b82d63feaac24bda64c2aa97cc4f867b1feaefff5
Opcode Fuzzy Hash: 72ec9215a177064e21c2d5a0a6f447d1c9ee7af3bfcf97e5d20168f13ed5ee57
Instruction Fuzzy Hash: 7C713A70641356BEEB218F65DC49FAABF68FF00364F244206F919A61E1C7B1AD10DB70

Function 00D56CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00D56DEB

Part of subcall function 00CC6B57: _wcslen.LIBCMT ref: 00CC6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00D56E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00D56E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D56E94
DestroyWindow.USER32(?), ref: 00D56EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00CC0000,00000000), ref: 00D56EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D56EFD
GetDesktopWindow.USER32 ref: 00D56F16
GetWindowRect.USER32(00000000), ref: 00D56F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00D56F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00D56F4D

Part of subcall function 00CD9944: GetWindowLongW.USER32(?,000000EB), ref: 00CD9952

Strings

0, xrefs: 00D56D98
tooltips_class32, xrefs: 00D56E58, 00D56EDD

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 8f27b3d13543b7316e5fe32faa461608e361057328d7b336c53a42f3635d8433
Instruction ID: c390add154a96daef6be03f836abaf56c9ec5d99bf7ecdc8368bf3b05765888f
Opcode Fuzzy Hash: 8f27b3d13543b7316e5fe32faa461608e361057328d7b336c53a42f3635d8433
Instruction Fuzzy Hash: BA716674504341AFDB21CF18D848FAABBE9EB89305F48491EFD9987260D770E90ADB21

Function 00D5911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00CD9BB2

DragQueryPoint.SHELL32(?,?), ref: 00D59147

Part of subcall function 00D57674: ClientToScreen.USER32(?,?), ref: 00D5769A
Part of subcall function 00D57674: GetWindowRect.USER32(?,?), ref: 00D57710
Part of subcall function 00D57674: PtInRect.USER32(?,?,00D58B89), ref: 00D57720

SendMessageW.USER32(?,000000B0,?,?), ref: 00D591B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00D591BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00D591DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00D59225
SendMessageW.USER32(?,000000B0,?,?), ref: 00D5923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00D59255
SendMessageW.USER32(?,000000B1,?,?), ref: 00D59277
DragFinish.SHELL32(?), ref: 00D5927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00D59371

Strings

@GUI_DRAGID, xrefs: 00D592E9
@GUI_DRAGFILE, xrefs: 00D59320
@GUI_DROPID, xrefs: 00D5929E

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 40ceaf6a22630ebbc82c482860a09e12b23ef11da8ba1d471854bc59bffe60bd
Instruction ID: 754646cf28c2dd1d1db626c43269bc0672b644b90e28bf64c4b1984f9c3842bc
Opcode Fuzzy Hash: 40ceaf6a22630ebbc82c482860a09e12b23ef11da8ba1d471854bc59bffe60bd
Instruction Fuzzy Hash: 03617F71108301AFD701DF64DC89EAFBBE8EF89751F40091EF995932A1DB309A49CB62

Function 00D3C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00D3C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00D3C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00D3C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00D3C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00D3C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00D3C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D3C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00D3C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00D3C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00D3C5F0
InternetCloseHandle.WININET(00000000), ref: 00D3C5FB

Strings

, xrefs: 00D3C575

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 8ddfef377d1d51f0f28f7ee6310f8d72b3bec3ef61e9a187ff150e381ad328ae
Instruction ID: e5e17a4c1ee28ce9e9430b0b0ca8a4675f2f35f529961464412c259b73d6afd0
Opcode Fuzzy Hash: 8ddfef377d1d51f0f28f7ee6310f8d72b3bec3ef61e9a187ff150e381ad328ae
Instruction Fuzzy Hash: 735139B1511308BFEB219F60C988AAB7BBCFF08755F046419F945E6610EB34E944DB70

Function 00D5856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00D58592
GetFileSize.KERNEL32(00000000,00000000), ref: 00D585A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00D585AD
CloseHandle.KERNEL32(00000000), ref: 00D585BA
GlobalLock.KERNEL32(00000000), ref: 00D585C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00D585D7
GlobalUnlock.KERNEL32(00000000), ref: 00D585E0
CloseHandle.KERNEL32(00000000), ref: 00D585E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00D585F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,00D5FC38,?), ref: 00D58611
GlobalFree.KERNEL32(00000000), ref: 00D58621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00D58641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00D58671
DeleteObject.GDI32(00000000), ref: 00D58699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00D586AF

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 4688afb9cc1643f3f087ebeb01426a23c0dcccdfcc16bbce12ba8a9e4c4b2b3d
Instruction ID: 6590e6ab0947a0d50b0816bf2a6b50bd13b5d6315331b473e61fc6fcc4bee336
Opcode Fuzzy Hash: 4688afb9cc1643f3f087ebeb01426a23c0dcccdfcc16bbce12ba8a9e4c4b2b3d
Instruction Fuzzy Hash: B441F975610308AFDB119FA5DC48EAA7BB8EF89712F144058FD16E7260DB309945DF70

Function 00D314BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00D31502
VariantCopy.OLEAUT32(?,?), ref: 00D3150B
VariantClear.OLEAUT32(?), ref: 00D31517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00D315FB
VarR8FromDec.OLEAUT32(?,?), ref: 00D31657
VariantInit.OLEAUT32(?), ref: 00D31708
SysFreeString.OLEAUT32(?), ref: 00D3178C
VariantClear.OLEAUT32(?), ref: 00D317D8
VariantClear.OLEAUT32(?), ref: 00D317E7
VariantInit.OLEAUT32(00000000), ref: 00D31823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00D31625
Default, xrefs: 00D316AF

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 7ffaeaec1a30e25fae0772067ff926b55f4517cf175267804f8c91bcc42415cb
Instruction ID: 2a8f54a74bac1e468196a9b91b228e7746accaca2b01ea4686ea3417b50c4f80
Opcode Fuzzy Hash: 7ffaeaec1a30e25fae0772067ff926b55f4517cf175267804f8c91bcc42415cb
Instruction Fuzzy Hash: C4D1EF75A00216EFDB10AF65E885B7DB7B5BF44700F18885AE846EB290DB30EC45EB71

Function 00D4B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

Part of subcall function 00D4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D4B6AE,?,?), ref: 00D4C9B5
Part of subcall function 00D4C998: _wcslen.LIBCMT ref: 00D4C9F1
Part of subcall function 00D4C998: _wcslen.LIBCMT ref: 00D4CA68
Part of subcall function 00D4C998: _wcslen.LIBCMT ref: 00D4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D4B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D4B772
RegDeleteValueW.ADVAPI32(?,?), ref: 00D4B80A
RegCloseKey.ADVAPI32(?), ref: 00D4B87E
RegCloseKey.ADVAPI32(?), ref: 00D4B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00D4B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00D4B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00D4B922
FreeLibrary.KERNEL32(00000000), ref: 00D4B983
RegCloseKey.ADVAPI32(00000000), ref: 00D4B994

Strings

advapi32.dll, xrefs: 00D4B8ED
RegDeleteKeyExW, xrefs: 00D4B8FE

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 5afc84806b70f4e00b35d317d875ca004dc20f93617e86c6f4eb8ce73a15f0f8
Instruction ID: b2641d8e63be8f5fd7462993093730fd76d7bf5c141071875d2b7d9d4ce75342
Opcode Fuzzy Hash: 5afc84806b70f4e00b35d317d875ca004dc20f93617e86c6f4eb8ce73a15f0f8
Instruction Fuzzy Hash: 90C16B30208701AFD714DF24C495F2ABBE5FF94318F18855DE49A8B2A2CB71ED46DBA1

Function 00D4255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D425D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00D425E8
CreateCompatibleDC.GDI32(?), ref: 00D425F4
SelectObject.GDI32(00000000,?), ref: 00D42601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00D4266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00D426AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00D426D0
SelectObject.GDI32(?,?), ref: 00D426D8
DeleteObject.GDI32(?), ref: 00D426E1
DeleteDC.GDI32(?), ref: 00D426E8
ReleaseDC.USER32(00000000,?), ref: 00D426F3

Strings

(, xrefs: 00D4268D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: bb9a403edc76446d9afb59a5416416102179a686205cc9b19e9c344bc4cefbb0
Instruction ID: 066b3aebf0a899941fea6064f8a88d8a4f5290ae34e951324e6c986579160737
Opcode Fuzzy Hash: bb9a403edc76446d9afb59a5416416102179a686205cc9b19e9c344bc4cefbb0
Instruction Fuzzy Hash: 3661CF75D00319EFCB04CFA8D884AAEBBB5FF48310F24852AE956A7350D770A951CFA4

Function 00CFDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00CFDAA1

Part of subcall function 00CFD63C: _free.LIBCMT ref: 00CFD659
Part of subcall function 00CFD63C: _free.LIBCMT ref: 00CFD66B
Part of subcall function 00CFD63C: _free.LIBCMT ref: 00CFD67D
Part of subcall function 00CFD63C: _free.LIBCMT ref: 00CFD68F
Part of subcall function 00CFD63C: _free.LIBCMT ref: 00CFD6A1
Part of subcall function 00CFD63C: _free.LIBCMT ref: 00CFD6B3
Part of subcall function 00CFD63C: _free.LIBCMT ref: 00CFD6C5
Part of subcall function 00CFD63C: _free.LIBCMT ref: 00CFD6D7
Part of subcall function 00CFD63C: _free.LIBCMT ref: 00CFD6E9
Part of subcall function 00CFD63C: _free.LIBCMT ref: 00CFD6FB
Part of subcall function 00CFD63C: _free.LIBCMT ref: 00CFD70D
Part of subcall function 00CFD63C: _free.LIBCMT ref: 00CFD71F
Part of subcall function 00CFD63C: _free.LIBCMT ref: 00CFD731

_free.LIBCMT ref: 00CFDA96

Part of subcall function 00CF29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00CFD7D1,00000000,00000000,00000000,00000000,?,00CFD7F8,00000000,00000007,00000000,?,00CFDBF5,00000000), ref: 00CF29DE
Part of subcall function 00CF29C8: GetLastError.KERNEL32(00000000,?,00CFD7D1,00000000,00000000,00000000,00000000,?,00CFD7F8,00000000,00000007,00000000,?,00CFDBF5,00000000,00000000), ref: 00CF29F0

_free.LIBCMT ref: 00CFDAB8
_free.LIBCMT ref: 00CFDACD
_free.LIBCMT ref: 00CFDAD8
_free.LIBCMT ref: 00CFDAFA
_free.LIBCMT ref: 00CFDB0D
_free.LIBCMT ref: 00CFDB1B
_free.LIBCMT ref: 00CFDB26
_free.LIBCMT ref: 00CFDB5E
_free.LIBCMT ref: 00CFDB65
_free.LIBCMT ref: 00CFDB82
_free.LIBCMT ref: 00CFDB9A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 3b786d4086caff55f555aa7a46cf5a7bf7ab248e68783034adc48b8d138175f1
Instruction ID: 0e14a11567426ec8bc7393ad1929bc0b043b940b2a9fbc9df9c6c2dfbca16bcc
Opcode Fuzzy Hash: 3b786d4086caff55f555aa7a46cf5a7bf7ab248e68783034adc48b8d138175f1
Instruction Fuzzy Hash: 78319C3164430D9FEBA1AE38E845B7A77EAFF00310F104419F26AD7191DA70EE80A726

Function 00D2365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00D2369C
_wcslen.LIBCMT ref: 00D236A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00D23797
GetClassNameW.USER32(?,?,00000400), ref: 00D2380C
GetDlgCtrlID.USER32(?), ref: 00D2385D
GetWindowRect.USER32(?,?), ref: 00D23882
GetParent.USER32(?), ref: 00D238A0
ScreenToClient.USER32(00000000), ref: 00D238A7
GetClassNameW.USER32(?,?,00000100), ref: 00D23921
GetWindowTextW.USER32(?,?,00000400), ref: 00D2395D

Strings

%s%u, xrefs: 00D23734

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: f1b47618ea72c7b9ad52f11e4df6937c0a20badfc3a5fd14b086811d205e6cca
Instruction ID: aab5ca124f0086dda44b95bb9cb47b3f3431deb6e5feac034dcf777a80960cd6
Opcode Fuzzy Hash: f1b47618ea72c7b9ad52f11e4df6937c0a20badfc3a5fd14b086811d205e6cca
Instruction Fuzzy Hash: FF91D171200716AFD718DF24D884BAAF7A8FF64318F048629F999C2190DB34EA45CBB1

Function 00D24954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00D24994
GetWindowTextW.USER32(?,?,00000400), ref: 00D249DA
_wcslen.LIBCMT ref: 00D249EB
CharUpperBuffW.USER32(?,00000000), ref: 00D249F7
_wcsstr.LIBVCRUNTIME ref: 00D24A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00D24A64
GetWindowTextW.USER32(?,?,00000400), ref: 00D24A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00D24AE6
GetClassNameW.USER32(?,?,00000400), ref: 00D24B20
GetWindowRect.USER32(?,?), ref: 00D24B8B

Strings

ThumbnailClass, xrefs: 00D24A6F, 00D24AF1

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: d9aa5e8ed68eb1696294688fdd0d54f6ac3cfe793ed2627c2a508b75cd276eaa
Instruction ID: 27dddfeafcc5e4d5c0009f2bf973a3b1866a1f2d2e1cf71450888a5f9aceaa3e
Opcode Fuzzy Hash: d9aa5e8ed68eb1696294688fdd0d54f6ac3cfe793ed2627c2a508b75cd276eaa
Instruction Fuzzy Hash: E291BD311043159FDB04DF14E985BAAB7E8FFA4318F088469FD859A196DB30ED45CBB1

Function 00D2BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00D91990,000000FF,00000000,00000030), ref: 00D2BFAC
SetMenuItemInfoW.USER32(00D91990,00000004,00000000,00000030), ref: 00D2BFE1
Sleep.KERNEL32(000001F4), ref: 00D2BFF3
GetMenuItemCount.USER32(?), ref: 00D2C039
GetMenuItemID.USER32(?,00000000), ref: 00D2C056
GetMenuItemID.USER32(?,-00000001), ref: 00D2C082
GetMenuItemID.USER32(?,?), ref: 00D2C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00D2C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D2C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D2C145

Strings

0, xrefs: 00D2BF3D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: a144fb2f01793bde8fb0f1e9a0ecaeebf78cf4934d0bc891b65f0371bafebef1
Instruction ID: b5f057395ab42813212b0d5ff706e7d3b08f68fc0a4271095933e56f0791fd52
Opcode Fuzzy Hash: a144fb2f01793bde8fb0f1e9a0ecaeebf78cf4934d0bc891b65f0371bafebef1
Instruction Fuzzy Hash: C861BDB092036AAFDF11CFA4ED89AAE7BB8EF15348F041055E841A3291D771AD14CBB0

Function 00D4CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00D4CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00D4CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00D4CD48

Part of subcall function 00D4CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00D4CCAA
Part of subcall function 00D4CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00D4CCBD
Part of subcall function 00D4CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00D4CCCF
Part of subcall function 00D4CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00D4CD05
Part of subcall function 00D4CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00D4CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00D4CCF3

Strings

advapi32.dll, xrefs: 00D4CCB8
RegDeleteKeyExW, xrefs: 00D4CCC9

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 92ba87842e84e156aaaff0818bd47f4dbb730563f59023e8cae9b7dccfdc6531
Instruction ID: a8fcb00735d3b0750b694249fc3cfaa5f05a35a35aa0a3d8a85af1816b5ee082
Opcode Fuzzy Hash: 92ba87842e84e156aaaff0818bd47f4dbb730563f59023e8cae9b7dccfdc6531
Instruction Fuzzy Hash: 98318A71A12329BFDB209BA4DC88EFFBB7CEF05751F041165A906E2250DB309A45DAB0

Function 00D33D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00D33D40
_wcslen.LIBCMT ref: 00D33D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00D33D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00D33DBE
RemoveDirectoryW.KERNEL32(?), ref: 00D33DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00D33E55
CloseHandle.KERNEL32(00000000), ref: 00D33E60
CloseHandle.KERNEL32(00000000), ref: 00D33E6B

Strings

:, xrefs: 00D33D82
\??\%s, xrefs: 00D33D5B
\, xrefs: 00D33D77

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 1138801ce35b70e1d0036ad0d40c60198a39df28ee20114eb73f2fb74ea4f9bf
Instruction ID: 1f1f9039c3432e07fb763f7d53b416942b63eae40c9d7f1f69e1235b8623a101
Opcode Fuzzy Hash: 1138801ce35b70e1d0036ad0d40c60198a39df28ee20114eb73f2fb74ea4f9bf
Instruction Fuzzy Hash: C831A172910349ABDB219BA0DD49FEB37BCEF88701F1041A6FA09D6160EB7097848B34

Function 00D2E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00D2E6B4

Part of subcall function 00CDE551: timeGetTime.WINMM(?,?,00D2E6D4), ref: 00CDE555

Sleep.KERNEL32(0000000A), ref: 00D2E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00D2E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00D2E727
SetActiveWindow.USER32 ref: 00D2E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00D2E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00D2E773
Sleep.KERNEL32(000000FA), ref: 00D2E77E
IsWindow.USER32 ref: 00D2E78A
EndDialog.USER32(00000000), ref: 00D2E79B

Strings

BUTTON, xrefs: 00D2E719

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: ef68f04a488f6815839128348e46b7a1e3ffb600ef66494ab310c1c1b17d886f
Instruction ID: 68a81ed02e61764a2e19a9fe2c328eb778ec2b52d40a32d732b6edb81f270bb8
Opcode Fuzzy Hash: ef68f04a488f6815839128348e46b7a1e3ffb600ef66494ab310c1c1b17d886f
Instruction Fuzzy Hash: 8A215EB0214315BFEB115F61FC8AA363B69F76574EB142426F916C27B2DB71AC009A34

Function 00D2E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00D2EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00D2EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D2EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00D2EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00D2EAA7

Strings

play PlayMe, xrefs: 00D2EAA2
status PlayMe mode, xrefs: 00D2EA58
close PlayMe, xrefs: 00D2EA6E, 00D2EA9B
alias PlayMe, xrefs: 00D2EA36
play PlayMe wait, xrefs: 00D2EA91
open , xrefs: 00D2EA0C

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 1ed9dd942008fcf5dea367f0fc41a5f565bb6b5f8430556f2584bece8077cd90
Instruction ID: 81f6d9de6fbe5840915c8e014bc11fe825d6e4ba7829d0f7654f9b8d9f443f6b
Opcode Fuzzy Hash: 1ed9dd942008fcf5dea367f0fc41a5f565bb6b5f8430556f2584bece8077cd90
Instruction Fuzzy Hash: 9C118631A902697DD720B7A2EC4AEFF6B7CEBD1B14F440469F811A20D1EE704D09CAB0

Function 00D29F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00D2A012
SetKeyboardState.USER32(?), ref: 00D2A07D
GetAsyncKeyState.USER32(000000A0), ref: 00D2A09D
GetKeyState.USER32(000000A0), ref: 00D2A0B4
GetAsyncKeyState.USER32(000000A1), ref: 00D2A0E3
GetKeyState.USER32(000000A1), ref: 00D2A0F4
GetAsyncKeyState.USER32(00000011), ref: 00D2A120
GetKeyState.USER32(00000011), ref: 00D2A12E
GetAsyncKeyState.USER32(00000012), ref: 00D2A157
GetKeyState.USER32(00000012), ref: 00D2A165
GetAsyncKeyState.USER32(0000005B), ref: 00D2A18E
GetKeyState.USER32(0000005B), ref: 00D2A19C

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: a70dd5db2f14a90f05981a3c93cd2a2af4e5d35243cac52a2966f9aed218bc1b
Instruction ID: b2cc91c94251536bbd7f45062f0376364276a620051c9f1806542e40a8112ba6
Opcode Fuzzy Hash: a70dd5db2f14a90f05981a3c93cd2a2af4e5d35243cac52a2966f9aed218bc1b
Instruction Fuzzy Hash: 04510B205047A42AFB35DBA4A9107EAFFB4DF22358F0C4599D5C2571C2DA549A4CCB72

Function 00D25CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00D25CE2
GetWindowRect.USER32(00000000,?), ref: 00D25CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00D25D59
GetDlgItem.USER32(?,00000002), ref: 00D25D69
GetWindowRect.USER32(00000000,?), ref: 00D25D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00D25DCF
GetDlgItem.USER32(?,000003E9), ref: 00D25DDD
GetWindowRect.USER32(00000000,?), ref: 00D25DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00D25E31
GetDlgItem.USER32(?,000003EA), ref: 00D25E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00D25E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00D25E67

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 91c5b6696ccb2532a03832dae16ebaae64c734626aafd09df5400e733d583267
Instruction ID: 0db21e5cf8a78d92d74c4926aed8bb8b33bf840559a7cdde8852f51a8852c4bf
Opcode Fuzzy Hash: 91c5b6696ccb2532a03832dae16ebaae64c734626aafd09df5400e733d583267
Instruction Fuzzy Hash: 46513D70A10715AFDB18CF68ED89EAEBBB5FB58301F148129F915E7294D7709E00CB60

Function 00CD8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00CD8BE8,?,00000000,?,?,?,?,00CD8BBA,00000000,?), ref: 00CD8FC5

DestroyWindow.USER32(?), ref: 00CD8C81
KillTimer.USER32(00000000,?,?,?,?,00CD8BBA,00000000,?), ref: 00CD8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00D16973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00CD8BBA,00000000,?), ref: 00D169A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00CD8BBA,00000000,?), ref: 00D169B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00CD8BBA,00000000), ref: 00D169D4
DeleteObject.GDI32(00000000), ref: 00D169E6

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 7e2963cfd3af4a3d49c9990b4695d3fefddbf8de38e93afda9dde55ff0799d76
Instruction ID: 2ece2257e11fb227cf7730e3c4aa37bd2347dfdafc8776b2336cece450bea9ca
Opcode Fuzzy Hash: 7e2963cfd3af4a3d49c9990b4695d3fefddbf8de38e93afda9dde55ff0799d76
Instruction Fuzzy Hash: C1619B34512701EFCB219F19E948B69BBF1FB84312F14451AE6529ABA0CB31A984DFB0

Function 00CD9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00CD9944: GetWindowLongW.USER32(?,000000EB), ref: 00CD9952

GetSysColor.USER32(0000000F), ref: 00CD9862

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: e27709bdf8c2024bb1dd638753f53ef54685fd0e6f7c522afc537f3bb38edd1f
Instruction ID: 2a12045a894fa8f55314f009c4cd2535d848a55a4372540b5252094b1ba0bdbb
Opcode Fuzzy Hash: e27709bdf8c2024bb1dd638753f53ef54685fd0e6f7c522afc537f3bb38edd1f
Instruction Fuzzy Hash: 3E418235104740AFDB205F389C88BB93BA6EB06772F144616FAB6873E1D7319D41EB20

Function 00D296E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00D0F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00D29717
LoadStringW.USER32(00000000,?,00D0F7F8,00000001), ref: 00D29720

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00D0F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00D29742
LoadStringW.USER32(00000000,?,00D0F7F8,00000001), ref: 00D29745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00D29866

Strings

Line %d:, xrefs: 00D297A0
%s (%d) : ==> %s: %s %s, xrefs: 00D2984A
Line %d (File "%s"):, xrefs: 00D2978F
Error: , xrefs: 00D2981D
^ ERROR, xrefs: 00D297FB

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: f5e79dce414cb9096372a522e882ba270e6540af4569b2f805aed7ce7d278901
Instruction ID: ea020a03343048509290cfbf1c9bd9e9fbe1ac67f250cc431f685ec134f2e8c3
Opcode Fuzzy Hash: f5e79dce414cb9096372a522e882ba270e6540af4569b2f805aed7ce7d278901
Instruction Fuzzy Hash: 87417F72900219AACB04FBE0ED96EEEB378EF55304F140029F60172092EB356F49DB71

Function 00D206DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC6B57: _wcslen.LIBCMT ref: 00CC6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00D207A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00D207BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00D207DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00D20804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00D2082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00D20837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00D2083C

Strings

\CLSID, xrefs: 00D20724
\IPC$, xrefs: 00D20784
SOFTWARE\Classes\, xrefs: 00D2070E

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: ffd659c53e371c55899b449cb156dddf36d132ff3c4023e7d5d477e3f335673a
Instruction ID: cde33a9e07f7a2ba72e8bc084d6b90fef7391cd5305f1176f5b0c12c8b9e7215
Opcode Fuzzy Hash: ffd659c53e371c55899b449cb156dddf36d132ff3c4023e7d5d477e3f335673a
Instruction Fuzzy Hash: D741E572D10229AFDF15EBA4EC95DEEB778FF54354F044169E901A32A1EB309E04DBA0

Function 00D53F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00D5403B
CreateCompatibleDC.GDI32(00000000), ref: 00D54042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00D54055
SelectObject.GDI32(00000000,00000000), ref: 00D5405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00D54068
DeleteDC.GDI32(00000000), ref: 00D54072
GetWindowLongW.USER32(?,000000EC), ref: 00D5407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00D54092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00D5409E

Strings

static, xrefs: 00D53FD3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 1731cb65751d27e118cf23ec9b77aacb879926d6265b3aff0ab314a2ea679c2e
Instruction ID: c1fd46c2e32d826544af96d5ae27f031ab18102890ceb14a465b56dbbd9d19bf
Opcode Fuzzy Hash: 1731cb65751d27e118cf23ec9b77aacb879926d6265b3aff0ab314a2ea679c2e
Instruction Fuzzy Hash: DC315732511315AFDF229FA8CC48FDA3BA8EF09326F101211FE19E61A0C735D855DBA0

Function 00D43C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D43C5C
CoInitialize.OLE32(00000000), ref: 00D43C8A
CoUninitialize.OLE32 ref: 00D43C94
_wcslen.LIBCMT ref: 00D43D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00D43DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00D43ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00D43F0E
CoGetObject.OLE32(?,00000000,00D5FB98,?), ref: 00D43F2D
SetErrorMode.KERNEL32(00000000), ref: 00D43F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00D43FC4
VariantClear.OLEAUT32(?), ref: 00D43FD8

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 4a72c81377fa9e3576ea47818372e043c9cf3a858fe569f1fc29556ab81b4d9e
Instruction ID: 2833c4daa659aeb0e23af903ea6e069b4bac362e245b9974f8108a7e972676f2
Opcode Fuzzy Hash: 4a72c81377fa9e3576ea47818372e043c9cf3a858fe569f1fc29556ab81b4d9e
Instruction Fuzzy Hash: F3C114716083059FD700DF68C88492BBBE9FF89748F14495DF98A9B251DB31EE05CBA2

Function 00D37A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00D37AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00D37B8F
SHGetDesktopFolder.SHELL32(?), ref: 00D37BA3
CoCreateInstance.OLE32(00D5FD08,00000000,00000001,00D86E6C,?), ref: 00D37BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00D37C74
CoTaskMemFree.OLE32(?,?), ref: 00D37CCC
SHBrowseForFolderW.SHELL32(?), ref: 00D37D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00D37D7A
CoTaskMemFree.OLE32(00000000), ref: 00D37D81
CoTaskMemFree.OLE32(00000000), ref: 00D37DD6
CoUninitialize.OLE32 ref: 00D37DDC

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 54cb8e814ce14d60cdb9b8b7a015edd928c90b9b94c9f2b22ebc6efdb4829d83
Instruction ID: a270fbc3f4c7aab280b88bd64caf6cec688b043d5f51030d0731c14628eecedb
Opcode Fuzzy Hash: 54cb8e814ce14d60cdb9b8b7a015edd928c90b9b94c9f2b22ebc6efdb4829d83
Instruction Fuzzy Hash: E1C1F775A04609AFCB14DFA4C884DAEBBB9EF48304F148599E819DB361D730EE45CBA0

Function 00D5541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00D55504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D55515
CharNextW.USER32(00000158), ref: 00D55544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00D55585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00D5559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D555AC

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: a4cd02e30d0c679a5209a34f74c34c252e1442237857cf81dcec3eaad6fa645f
Instruction ID: 03f6e42e1300131f9b6af762726f22a0397dd506d46196a4bf3e74a52cc841e6
Opcode Fuzzy Hash: a4cd02e30d0c679a5209a34f74c34c252e1442237857cf81dcec3eaad6fa645f
Instruction Fuzzy Hash: 32618B34900709EFDF128F90EC94AFE3BB9EB09322F144145FD65A62A4D7748A889F70

Function 00D1FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00D1FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00D1FB08
VariantInit.OLEAUT32(?), ref: 00D1FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00D1FB3A
VariantCopy.OLEAUT32(?,?), ref: 00D1FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00D1FBA1
VariantClear.OLEAUT32(?), ref: 00D1FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00D1FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00D1FBCC
VariantClear.OLEAUT32(?), ref: 00D1FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00D1FBE9

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: e2fada65b4efed7db83b302ce32b1e9ed83c79d155879884b0e1cf66891abbd8
Instruction ID: 34576da4958e5cdc9800c727667730b9d89974a9282c5d2b8366229f9c34e956
Opcode Fuzzy Hash: e2fada65b4efed7db83b302ce32b1e9ed83c79d155879884b0e1cf66891abbd8
Instruction Fuzzy Hash: BA413D75A00319AFCB00DF68D854DEEBBB9EF48345F048069E955E7261CB34A986CBB0

Function 00D29C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00D29CA1
GetAsyncKeyState.USER32(000000A0), ref: 00D29D22
GetKeyState.USER32(000000A0), ref: 00D29D3D
GetAsyncKeyState.USER32(000000A1), ref: 00D29D57
GetKeyState.USER32(000000A1), ref: 00D29D6C
GetAsyncKeyState.USER32(00000011), ref: 00D29D84
GetKeyState.USER32(00000011), ref: 00D29D96
GetAsyncKeyState.USER32(00000012), ref: 00D29DAE
GetKeyState.USER32(00000012), ref: 00D29DC0
GetAsyncKeyState.USER32(0000005B), ref: 00D29DD8
GetKeyState.USER32(0000005B), ref: 00D29DEA

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 59b35cd0f7f80de3b53f9aa7506cb7b46dea5c8e7ee866721760dad572c68a9e
Instruction ID: b246bc47f60b1aeddc00d3168c12b28855e7a34fe39d7ffb7976ec53199a60e8
Opcode Fuzzy Hash: 59b35cd0f7f80de3b53f9aa7506cb7b46dea5c8e7ee866721760dad572c68a9e
Instruction Fuzzy Hash: DE41C6345047D96DFF319660E8243B5FEA06F31348F0C805ADAC6566C2EBA599C8D7B2

Function 00D4055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00D405BC
inet_addr.WSOCK32(?), ref: 00D4061C
gethostbyname.WSOCK32(?), ref: 00D40628
IcmpCreateFile.IPHLPAPI ref: 00D40636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00D406C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00D406E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00D407B9
WSACleanup.WSOCK32 ref: 00D407BF

Strings

Ping, xrefs: 00D40676

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 6905312e2940b84a114ebe5623feb06b8f592c71b27f2b445cda8f4e860a3e39
Instruction ID: 7629c1e337c40051aff210ae638032424a90294537f766b7db1cdf7a0fbc6327
Opcode Fuzzy Hash: 6905312e2940b84a114ebe5623feb06b8f592c71b27f2b445cda8f4e860a3e39
Instruction Fuzzy Hash: 8B915D755043019FD720DF15C489F1ABBE0EF48318F1985A9E6AA9B7A2C730ED45CFA2

Function 00D48CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00D48CF3

Part of subcall function 00D28E54: _wcslen.LIBCMT ref: 00D28E77

_wcslen.LIBCMT ref: 00D48D4E
_wcslen.LIBCMT ref: 00D48D9C
_wcslen.LIBCMT ref: 00D48DDC
_wcslen.LIBCMT ref: 00D48E6E

Strings

stdcall, xrefs: 00D48DD6, 00D48DDB
none, xrefs: 00D48E65, 00D48E6A
cdecl, xrefs: 00D48D48, 00D48D4D
winapi, xrefs: 00D48D96, 00D48D9B

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 6c502d5ae949a2085b48964ebf9c8d376a19a76928190e4033b446aefd03d5cf
Instruction ID: 055147517b87b2b60b9e511b53c5e58f64dff12e39075ab4bae01dfcbcbd985e
Opcode Fuzzy Hash: 6c502d5ae949a2085b48964ebf9c8d376a19a76928190e4033b446aefd03d5cf
Instruction Fuzzy Hash: E251B231A001169BCF14DF6CC9419BEB7A5FF643A4B284229F866E72C4EB31DD40E7A0

Function 00D4372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00D43774
CoUninitialize.OLE32 ref: 00D4377F
CoCreateInstance.OLE32(?,00000000,00000017,00D5FB78,?), ref: 00D437D9
IIDFromString.OLE32(?,?), ref: 00D4384C
VariantInit.OLEAUT32(?), ref: 00D438E4
VariantClear.OLEAUT32(?), ref: 00D43936

Strings

Invalid parameter, xrefs: 00D43865
Failed to create object, xrefs: 00D437E4, 00D4389A
NULL Pointer assignment, xrefs: 00D4381E

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: d7fde5469d0ac969a4a12ca9e57744b6b6710920b6dc4c799f9252f66f1861df
Instruction ID: fe8ffd64a58acf34347fdd90c1fbd81056f3f7fdf4cbbbee23efa84fe62791d7
Opcode Fuzzy Hash: d7fde5469d0ac969a4a12ca9e57744b6b6710920b6dc4c799f9252f66f1861df
Instruction Fuzzy Hash: 74618A70608311AFD310DF68C889F6ABBE8EF48715F144919F9859B291C770EE48DBB2

Function 00D33388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00D333CF

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00D333F0

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00D33504
Incorrect parameters to object property !, xrefs: 00D334AB
Line %d (File "%s"):, xrefs: 00D33443, 00D3345C
Error: , xrefs: 00D334D1
^ ERROR , xrefs: 00D3349E
"%s" (%d) : ==> %s:, xrefs: 00D33522

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 899a5bab5a068e8f1260b09df98689e255c1a8c7fff058c9198ab4170f8fbfd7
Instruction ID: e35932474afbbf63e8c025282a0ca04ef7f289dc21dd411b747109b43b2a2fa1
Opcode Fuzzy Hash: 899a5bab5a068e8f1260b09df98689e255c1a8c7fff058c9198ab4170f8fbfd7
Instruction Fuzzy Hash: 7A517C3190020AAADF15EBE0DE46EEEB778EF14340F144169F505B21A2EB316F58EB70

Function 00D2B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00D2B5FC
_wcslen.LIBCMT ref: 00D2B608
_wcslen.LIBCMT ref: 00D2B64D
_wcslen.LIBCMT ref: 00D2B68C
_wcslen.LIBCMT ref: 00D2B6C7

Strings

REMOVE, xrefs: 00D2B602, 00D2B607
APPEND, xrefs: 00D2B6C1, 00D2B6C6
EXISTS, xrefs: 00D2B686, 00D2B68B
KEYS, xrefs: 00D2B647, 00D2B64C

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: fcf8fdfdba4c7079e755a34323b4870d3e2d42737001225376b9dca2907292c7
Instruction ID: 58e50ae4078b27ebef22f896495a73430b1fc76e39bc11eb931f029e3a894b3f
Opcode Fuzzy Hash: fcf8fdfdba4c7079e755a34323b4870d3e2d42737001225376b9dca2907292c7
Instruction Fuzzy Hash: B641A632A001369ACB206F7D9C905BE77A5ABB077DB28412AE461DB284E771CD81C7B0

Function 00D35393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D353A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00D35416
GetLastError.KERNEL32 ref: 00D35420
SetErrorMode.KERNEL32(00000000,READY), ref: 00D354A7

Strings

INVALID, xrefs: 00D35459
READONLY, xrefs: 00D35452
NOTREADY, xrefs: 00D3544B
READY, xrefs: 00D35460, 00D35468
UNKNOWN, xrefs: 00D35444

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: be983a7e4b72e5a4ce51d898118791d8df6c32643c962443d0c18d03137657ea
Instruction ID: 1dcdc5593f892c561098371f95ab0e805891a5d1a4e30d5b17888accaa35f3a9
Opcode Fuzzy Hash: be983a7e4b72e5a4ce51d898118791d8df6c32643c962443d0c18d03137657ea
Instruction Fuzzy Hash: 6131A135A006049FD718DF68D884FAABBB4EF45315F188069E806CB3A6D771DD86CBB0

Function 00D53C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00D53C79
SetMenu.USER32(?,00000000), ref: 00D53C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D53D10
IsMenu.USER32(?), ref: 00D53D24
CreatePopupMenu.USER32 ref: 00D53D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00D53D5B
DrawMenuBar.USER32 ref: 00D53D63

Strings

0, xrefs: 00D53C54
F, xrefs: 00D53D4E

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: b28d181d860a4a82aafe458b36bd6b30c14eefd4e62e47d116435edf016c319c
Instruction ID: 2766b71b5798e5c76d1b8ca92f9ce5b03d73798240ef4e47bd211eb2739bc6f4
Opcode Fuzzy Hash: b28d181d860a4a82aafe458b36bd6b30c14eefd4e62e47d116435edf016c319c
Instruction Fuzzy Hash: 6C415979A01309AFDF14CFA4D844BAA7BB5FF49391F180029ED5697360D730AA14CFA0

Function 00D21EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

Part of subcall function 00D23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00D23CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00D21F64
GetDlgCtrlID.USER32 ref: 00D21F6F
GetParent.USER32 ref: 00D21F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00D21F8E
GetDlgCtrlID.USER32(?), ref: 00D21F97
GetParent.USER32(?), ref: 00D21FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00D21FAE

Strings

ComboBox, xrefs: 00D21EEC
ListBox, xrefs: 00D21F21

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 1e85c5670138b6d214b85cf508f359be1f396fe8246c8885ab4551aa2dee3f2b
Instruction ID: 7d87795baacaff51fcf785ccc50cdb817298b96ca1f3728bba7a6f953b63b022
Opcode Fuzzy Hash: 1e85c5670138b6d214b85cf508f359be1f396fe8246c8885ab4551aa2dee3f2b
Instruction Fuzzy Hash: D421A175900314BFCF04AFA0DC45EEEBBA8EF25314B004155F961A72A1CB345A18DB70

Function 00D21FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

Part of subcall function 00D23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00D23CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00D22043
GetDlgCtrlID.USER32 ref: 00D2204E
GetParent.USER32 ref: 00D2206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00D2206D
GetDlgCtrlID.USER32(?), ref: 00D22076
GetParent.USER32(?), ref: 00D2208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00D2208D

Strings

ComboBox, xrefs: 00D21FCD
ListBox, xrefs: 00D22002

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: c228292f11692561ecfde4f765c8c07c51084499e45e28cd85e29a43793981ff
Instruction ID: 67359558ef26e8d63d064b05f9e4b9233074c1ec22ecb8b58d818f3054af7b5f
Opcode Fuzzy Hash: c228292f11692561ecfde4f765c8c07c51084499e45e28cd85e29a43793981ff
Instruction Fuzzy Hash: 7B218075A00314BFCB10AFA0DC45EFEBBB8EB15344F004455F951A72A1DA759A14DB70

Function 00D53A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00D53A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00D53AA0
GetWindowLongW.USER32(?,000000F0), ref: 00D53AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00D53AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00D53B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00D53BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00D53BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00D53BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00D53BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00D53C13

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 8939f7f0c959e09fcca912ce4244d0fb3ec307f7bd0c34b4baeb0bb9096e4bb6
Instruction ID: f00f2ad0a654a0517ba181bcaa4d6d5bb1346b425cea157d1df7656ed87a0f20
Opcode Fuzzy Hash: 8939f7f0c959e09fcca912ce4244d0fb3ec307f7bd0c34b4baeb0bb9096e4bb6
Instruction Fuzzy Hash: 07615875A00248AFDB11DFA8CC81EEE77B8EB09740F14419AFE15E72A1D770AE45DB60

Function 00CF2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CF2C94

Part of subcall function 00CF29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00CFD7D1,00000000,00000000,00000000,00000000,?,00CFD7F8,00000000,00000007,00000000,?,00CFDBF5,00000000), ref: 00CF29DE
Part of subcall function 00CF29C8: GetLastError.KERNEL32(00000000,?,00CFD7D1,00000000,00000000,00000000,00000000,?,00CFD7F8,00000000,00000007,00000000,?,00CFDBF5,00000000,00000000), ref: 00CF29F0

_free.LIBCMT ref: 00CF2CA0
_free.LIBCMT ref: 00CF2CAB
_free.LIBCMT ref: 00CF2CB6
_free.LIBCMT ref: 00CF2CC1
_free.LIBCMT ref: 00CF2CCC
_free.LIBCMT ref: 00CF2CD7
_free.LIBCMT ref: 00CF2CE2
_free.LIBCMT ref: 00CF2CED
_free.LIBCMT ref: 00CF2CFB

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7b939c4ebff9df326e91120e258b32a338dc1515b70473a6e9bd4a760f07c7fc
Instruction ID: b8a83e179ba0efa545a2fa4aba0525ae8a9557006035a8e86bcf7ccaf292fbe2
Opcode Fuzzy Hash: 7b939c4ebff9df326e91120e258b32a338dc1515b70473a6e9bd4a760f07c7fc
Instruction Fuzzy Hash: 0111A47614010DAFCB82EF94D882CED3BA5FF05350F4144A5FA489F222DA71EF50AB92

Function 00CC1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00CC1459
OleUninitialize.OLE32(?,00000000), ref: 00CC14F8
UnregisterHotKey.USER32(?), ref: 00CC16DD
DestroyWindow.USER32(?), ref: 00D024B9
FreeLibrary.KERNEL32(?), ref: 00D0251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00D0254B

Strings

close all, xrefs: 00CC1454

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 30001ebe21eaaeb522fc9e2c7ff228895e119d50bb445fbefa1534b2825dfb8e
Instruction ID: 2c7a633f20aca33899ce92242d0e6db513935277373713f412577a3da558424f
Opcode Fuzzy Hash: 30001ebe21eaaeb522fc9e2c7ff228895e119d50bb445fbefa1534b2825dfb8e
Instruction Fuzzy Hash: 3DD14C317022128FCB19EF16C899F29F7A4BF05711F18419DE94AAB292DB31ED12DF64

Function 00D37DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00D37FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00D37FC1
GetFileAttributesW.KERNEL32(?), ref: 00D37FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00D38005
SetCurrentDirectoryW.KERNEL32(?), ref: 00D38017
SetCurrentDirectoryW.KERNEL32(?), ref: 00D38060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00D380B0

Strings

*.*, xrefs: 00D38066

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 10c6007a70f5b752f0790d0d2f42d2937c0d5dd52dd5bf761d366a36a7e2e88d
Instruction ID: 6b8cd1aaec2ae141f2b2ade1caf0e0943a928e44af2cfd0801dc2d6f9eda9159
Opcode Fuzzy Hash: 10c6007a70f5b752f0790d0d2f42d2937c0d5dd52dd5bf761d366a36a7e2e88d
Instruction Fuzzy Hash: 7C8181B25087469FCB34DF54C884AAAB3E8BF88314F18486EF885D7250DB35DD45DB62

Function 00CC5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00CC5C7A

Part of subcall function 00CC5D0A: GetClientRect.USER32(?,?), ref: 00CC5D30
Part of subcall function 00CC5D0A: GetWindowRect.USER32(?,?), ref: 00CC5D71
Part of subcall function 00CC5D0A: ScreenToClient.USER32(?,?), ref: 00CC5D99

GetDC.USER32 ref: 00D046F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00D04708
SelectObject.GDI32(00000000,00000000), ref: 00D04716
SelectObject.GDI32(00000000,00000000), ref: 00D0472B
ReleaseDC.USER32(?,00000000), ref: 00D04733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00D047C4

Strings

U, xrefs: 00D04693

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 77c93219b3c2a4d9c4b5c529e8da15262f1f1a467156c4692bbc0a444505651a
Instruction ID: 05c2aebc747cdc999f528a577be1a8c858ad57a7674e6792e14ada5bfa2669a5
Opcode Fuzzy Hash: 77c93219b3c2a4d9c4b5c529e8da15262f1f1a467156c4692bbc0a444505651a
Instruction Fuzzy Hash: 7271AE74400205DFCF218F64C984FAA3BB5FF8A351F184269EE595A2A6D7319881DFB0

Function 00D3359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00D335E4

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

LoadStringW.USER32(00D92390,?,00000FFF,?), ref: 00D3360A

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00D33724
Line %d (File "%s"):, xrefs: 00D3366B
Error: , xrefs: 00D336EF
^ ERROR, xrefs: 00D336C9
"%s" (%d) : ==> %s:, xrefs: 00D33742

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 2009207985a30fb82a97af3f781999e6163825e5f6839162176ecebb00c930f8
Instruction ID: 1b94d6e713a1f6463db16e14e8382f7fe0d3199d15a40d0d771344d939aba084
Opcode Fuzzy Hash: 2009207985a30fb82a97af3f781999e6163825e5f6839162176ecebb00c930f8
Instruction Fuzzy Hash: FF516D71D0024ABADF14EBA0DD46EEEBB38EF14340F184129F505721A1EB315A99EF70

Function 00D3C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00D3C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D3C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00D3C2CA
GetLastError.KERNEL32 ref: 00D3C322
SetEvent.KERNEL32(?), ref: 00D3C336
InternetCloseHandle.WININET(00000000), ref: 00D3C341

Strings

, xrefs: 00D3C2BB

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 20628009596aa273e5a18731e7a1df27f6363ee52d3eb27dd95c1d020704d3c3
Instruction ID: 8957b868fb82a69e8b3e458d1d300461216e3059db6af567a9000d8cf33047bc
Opcode Fuzzy Hash: 20628009596aa273e5a18731e7a1df27f6363ee52d3eb27dd95c1d020704d3c3
Instruction Fuzzy Hash: F0316BB1620308AFD7219F648C88AAB7BFCEB49744F14951EF886E2210DB30DD059B71

Function 00D2989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00D03AAF,?,?,Bad directive syntax error,00D5CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00D298BC
LoadStringW.USER32(00000000,?,00D03AAF,?), ref: 00D298C3

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00D29987

Strings

., xrefs: 00D2996D
%s (%d) : ==> %s.: %s %s, xrefs: 00D298F1
Line %d:, xrefs: 00D29912
Error: , xrefs: 00D29955
Line %d (File "%s"):, xrefs: 00D2992D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 7d4f2d2f345a908e9a027fdbab9161dab765a86cd8796a5e1cbe7929d84e3066
Instruction ID: 1f36eb2e35d1674888641b23d2371c4ab86bbb1da254ee7c98695758a4f76a39
Opcode Fuzzy Hash: 7d4f2d2f345a908e9a027fdbab9161dab765a86cd8796a5e1cbe7929d84e3066
Instruction Fuzzy Hash: 4C216B32D4435ABFCF11AF90DC1AEEE7735FF28305F08542AF515660A2EA319658EB20

Function 00D2209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00D220AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00D220C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00D2214D

Strings

details, xrefs: 00D220FB
SHELLDLL_DefView, xrefs: 00D220CC
list, xrefs: 00D2212F
smallicons, xrefs: 00D22115
largeicons, xrefs: 00D220E1

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 4d62c9f7b65a0caee4cc34bb25ffc83f5ab3f93f816e98f2bd77b139487de663
Instruction ID: 8e32cec0cf9257df1b6e04ed81f0f0b00cdbc076e9ffd3b9ee41b017c7781368
Opcode Fuzzy Hash: 4d62c9f7b65a0caee4cc34bb25ffc83f5ab3f93f816e98f2bd77b139487de663
Instruction Fuzzy Hash: 5D11067A688717BDF6163621FC07DF6379CDF25728B200126FB04A50E5FE61A8256638

Function 00CF8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6834852972b5ad550745b4507ab5acb8abdd0c9d07bd9a6f5cc39738812e8ca
Instruction ID: ce5f3fd5eb20a2179e18ec31503c7a790c48fba94a58b40b5e229bce01fad571
Opcode Fuzzy Hash: f6834852972b5ad550745b4507ab5acb8abdd0c9d07bd9a6f5cc39738812e8ca
Instruction Fuzzy Hash: 7CC1E17590434DAFDF51DFA9D841BBDBBB0EF09310F044099EA25A7392CB358A41CB62

Function 00CFCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00CFCEB7
_free.LIBCMT ref: 00CFCF22
_free.LIBCMT ref: 00CFCF48
_free.LIBCMT ref: 00CFCF71
_free.LIBCMT ref: 00CFCFA9
_free.LIBCMT ref: 00CFCFDA
_free.LIBCMT ref: 00CFD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00CFD09C
_free.LIBCMT ref: 00CFD0B5

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 656fe7c1a5c2de22b818af1285d5e2dc36681b1ee111573f7445f3118575855c
Instruction ID: ac137192632e38e2fdb92dd1fc3b9f220718addceee64adf00ead374e5b2bf1f
Opcode Fuzzy Hash: 656fe7c1a5c2de22b818af1285d5e2dc36681b1ee111573f7445f3118575855c
Instruction Fuzzy Hash: 01615871A0430DAFDBA1AFF4A9C1A7ABBA5EF01310F04416EFB11D7281DB319E019762

Function 00D550D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00D55186
ShowWindow.USER32(?,00000000), ref: 00D551C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00D551CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00D551D1

Part of subcall function 00D56FBA: DeleteObject.GDI32(00000000), ref: 00D56FE6

GetWindowLongW.USER32(?,000000F0), ref: 00D5520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D5521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00D5524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00D55287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00D55296

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 4ed73c322882c6b20402f4e87dca7fee6902aa373828aa75156ca8716ececb8b
Instruction ID: e8bc484fa37104933901f1c98a2b4213f85f1397190c1c167e59dffeb65954f8
Opcode Fuzzy Hash: 4ed73c322882c6b20402f4e87dca7fee6902aa373828aa75156ca8716ececb8b
Instruction Fuzzy Hash: 9751B530A50B09BEEF229F24EC55F983BA1EB05323F144012FE19962E4C771A988DF71

Function 00CD8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00D16890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00D168A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00D168B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00D168D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00D168F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00CD8874,00000000,00000000,00000000,000000FF,00000000), ref: 00D16901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00D1691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00CD8874,00000000,00000000,00000000,000000FF,00000000), ref: 00D1692D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 862db06a6a76b4645a9d1e04150530d0610304e55e2cf8502fe2a5af781a7b6f
Instruction ID: 5cd57d9b7e8b1e5112882c3191f0a0678f902c83c6e4f8d2bdc56ce4f5e74d9b
Opcode Fuzzy Hash: 862db06a6a76b4645a9d1e04150530d0610304e55e2cf8502fe2a5af781a7b6f
Instruction Fuzzy Hash: 75518574600309BFDB20CF25DC91FAA7BB5EB48751F14451AFA22D62A0DB70EA90DB60

Function 00D3C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00D3C182
GetLastError.KERNEL32 ref: 00D3C195
SetEvent.KERNEL32(?), ref: 00D3C1A9

Part of subcall function 00D3C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00D3C272
Part of subcall function 00D3C253: GetLastError.KERNEL32 ref: 00D3C322
Part of subcall function 00D3C253: SetEvent.KERNEL32(?), ref: 00D3C336
Part of subcall function 00D3C253: InternetCloseHandle.WININET(00000000), ref: 00D3C341

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 41c1f04939d7d161542a6798b15ce8c5cf1a13bcb1ca1c28a3113b942a713a11
Instruction ID: 43ee43f34d5d25ceae4ebd471a8603201c7a148916f1bb41368a67cc9e6b50de
Opcode Fuzzy Hash: 41c1f04939d7d161542a6798b15ce8c5cf1a13bcb1ca1c28a3113b942a713a11
Instruction Fuzzy Hash: 7A316775220705AFDB219FA59C44A6BBBE8FF18341F04642DF95AE6620D730E814EBB4

Function 00D225A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D23A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00D23A57
Part of subcall function 00D23A3D: GetCurrentThreadId.KERNEL32 ref: 00D23A5E
Part of subcall function 00D23A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00D225B3), ref: 00D23A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00D225BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00D225DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00D225DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00D225E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00D22601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00D22605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00D2260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00D22623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00D22627

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: e354394d001821cfe6058ca68b2af61f0611bf11a0ce218b9f8cc56e48e790ac
Instruction ID: d2129a01a562dbb02f159f4430446e307db34e95c4195528c79385ea39958477
Opcode Fuzzy Hash: e354394d001821cfe6058ca68b2af61f0611bf11a0ce218b9f8cc56e48e790ac
Instruction Fuzzy Hash: B001D831390720BBFB1067689C8AF593F99DB5EB16F101011F754EE1E1CDE154448A79

Function 00D21803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00D21449,?,?,00000000), ref: 00D2180C
HeapAlloc.KERNEL32(00000000,?,00D21449,?,?,00000000), ref: 00D21813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00D21449,?,?,00000000), ref: 00D21828
GetCurrentProcess.KERNEL32(?,00000000,?,00D21449,?,?,00000000), ref: 00D21830
DuplicateHandle.KERNEL32(00000000,?,00D21449,?,?,00000000), ref: 00D21833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00D21449,?,?,00000000), ref: 00D21843
GetCurrentProcess.KERNEL32(00D21449,00000000,?,00D21449,?,?,00000000), ref: 00D2184B
DuplicateHandle.KERNEL32(00000000,?,00D21449,?,?,00000000), ref: 00D2184E
CreateThread.KERNEL32(00000000,00000000,00D21874,00000000,00000000,00000000), ref: 00D21868

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: e6e38b4681e5cca433451a0513a5b14bd3a21ff5a8c6dba7bb3c9c021df6e55c
Instruction ID: 366e6d3f64a4129c4b273cb3bbaa04dfe8a9602da87085114919c71004200b4e
Opcode Fuzzy Hash: e6e38b4681e5cca433451a0513a5b14bd3a21ff5a8c6dba7bb3c9c021df6e55c
Instruction Fuzzy Hash: 3E01BBB5650708BFE710ABB5DC4DF6B7BACEB89B11F009411FA15DB2A1CA709840CB30

Function 00D4A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00D2D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00D2D501
Part of subcall function 00D2D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00D2D50F
Part of subcall function 00D2D4DC: CloseHandle.KERNEL32(00000000), ref: 00D2D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00D4A16D
GetLastError.KERNEL32 ref: 00D4A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00D4A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00D4A268
GetLastError.KERNEL32(00000000), ref: 00D4A273
CloseHandle.KERNEL32(00000000), ref: 00D4A2C4

Strings

SeDebugPrivilege, xrefs: 00D4A18F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 7fe6a2730626c9ca21ecd10aacba1dc70375a48323abe3c8f9866ae5c52e2e1e
Instruction ID: 19254fe426884796e3ef58a9d709bafca05657746383a8e569b949963d80255b
Opcode Fuzzy Hash: 7fe6a2730626c9ca21ecd10aacba1dc70375a48323abe3c8f9866ae5c52e2e1e
Instruction Fuzzy Hash: B2616C302443429FD710DF18C4D4F1ABBA1AF54318F18849CE46A8B7A2C7B2ED46DBA6

Function 00D53886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00D53925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00D5393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00D53954
_wcslen.LIBCMT ref: 00D53999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00D539C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00D539F4

Strings

SysListView32, xrefs: 00D538F7

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: c266ef1c4fd52b22f67058f7eaa5475ac42fce0304a39a05de2b454c064012f3
Instruction ID: 1c6313eab5726b38c72297ddd028ac32bc471498a725281a3581a93d7f082405
Opcode Fuzzy Hash: c266ef1c4fd52b22f67058f7eaa5475ac42fce0304a39a05de2b454c064012f3
Instruction Fuzzy Hash: 4A418471A00319ABEF219F64CC45BEA7BA9EF08391F140526FD58E7291D771DA84CFA0

Function 00D2BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D2BCFD
IsMenu.USER32(00000000), ref: 00D2BD1D
CreatePopupMenu.USER32 ref: 00D2BD53
GetMenuItemCount.USER32(011C5490), ref: 00D2BDA4
InsertMenuItemW.USER32(011C5490,?,00000001,00000030), ref: 00D2BDCC

Strings

2, xrefs: 00D2BD37
0, xrefs: 00D2BCA8

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 4e8b421a8e876fdecef7ce91f002a5a92fd6f1426f666902877445b139ff0ca8
Instruction ID: 02d7caf217f712ba2a836d23150bedff6e71bf2358766d0d7f383b6b8834e888
Opcode Fuzzy Hash: 4e8b421a8e876fdecef7ce91f002a5a92fd6f1426f666902877445b139ff0ca8
Instruction Fuzzy Hash: CF5190706003259BDB10DFA8E884BEEBBF4FF65328F18415AE852D7291E7B09945CB71

Function 00D2C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00D2C913

Strings

blank, xrefs: 00D2C895
question, xrefs: 00D2C8CC
info, xrefs: 00D2C8B4
warning, xrefs: 00D2C8FC
stop, xrefs: 00D2C8E4

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: d6c7616dca00f2a29578bff06eed8cebcbc48a9125673e82120226de71de5d00
Instruction ID: 55784a8672b0d59b51a729fce895f4e7066416d2391dd138e1806446bca0e0ce
Opcode Fuzzy Hash: d6c7616dca00f2a29578bff06eed8cebcbc48a9125673e82120226de71de5d00
Instruction Fuzzy Hash: 08113D31699316BEE7046B55BC83CAE679CDF3537EB20103AF500A6282D7B0DE4067B8

Function 00D2DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00D2DE42
gethostname.WSOCK32(?,00000100), ref: 00D2DE5C
gethostbyname.WSOCK32(?), ref: 00D2DE69
inet_ntoa.WSOCK32(?), ref: 00D2DEAB
_strcat.LIBCMT ref: 00D2DEB9
WSACleanup.WSOCK32 ref: 00D2DEDE

Strings

0.0.0.0, xrefs: 00D2DE87

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: d12e048a48535b1052e9ca5e6a0637ffb47421901b7ebed0aecc531210b28ebf
Instruction ID: 41d6af29f6339a73c07572e3af4e34db3f24c50daaa5a759999413b07a80dbad
Opcode Fuzzy Hash: d12e048a48535b1052e9ca5e6a0637ffb47421901b7ebed0aecc531210b28ebf
Instruction Fuzzy Hash: 36115C71404314AFCB24BB20EC0AEEE377CDF24315F050169F885E6191EF75CA819A70

Function 00D59F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00CD9BB2

GetSystemMetrics.USER32(0000000F), ref: 00D59FC7
GetSystemMetrics.USER32(0000000F), ref: 00D59FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00D5A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00D5A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00D5A263
ShowWindow.USER32(00000003,00000000), ref: 00D5A282
InvalidateRect.USER32(?,00000000,00000001), ref: 00D5A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 00D5A2CA

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: b86e8aabc7c82e623686e5457b03aaea3efcc729f1f98658d61432f7d3342e34
Instruction ID: 5d6499fb5b90f13e046b92909b3828298ef8819dabd63a626157ec72efffe781
Opcode Fuzzy Hash: b86e8aabc7c82e623686e5457b03aaea3efcc729f1f98658d61432f7d3342e34
Instruction Fuzzy Hash: EDB16935600325AFDF14CF6CC985BAE7BB2BF44702F089169EC859B295D731A944CB61

Function 00D2ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00D2ED2A
_wcslen.LIBCMT ref: 00D2ED3B
_wcslen.LIBCMT ref: 00D2ED79
_wcslen.LIBCMT ref: 00D2EDAF
_wcslen.LIBCMT ref: 00D2EDDF
_wcslen.LIBCMT ref: 00D2EDEF
_wcslen.LIBCMT ref: 00D2EE2B
_wcslen.LIBCMT ref: 00D2EE5A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 41589b06cdb17f1d4bc58cf70ca84a02241ccca0f08030b4d60b3f01e2ba8b57
Instruction ID: 522da7ef4489ae47f6dab847601deda5c1f35a756e46739302557508ecc083d4
Opcode Fuzzy Hash: 41589b06cdb17f1d4bc58cf70ca84a02241ccca0f08030b4d60b3f01e2ba8b57
Instruction Fuzzy Hash: 6C41AE65C1026876CB11EBB5C88A9CFB7ACAF55310F508462FA18F3122FB34E645D3E6

Function 00CDF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00D1682C,00000004,00000000,00000000), ref: 00CDF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00D1682C,00000004,00000000,00000000), ref: 00D1F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00D1682C,00000004,00000000,00000000), ref: 00D1F454

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: f6e11a59fce4ac53a83f3121a53598975f1015e7b274d191586ffc7bf631165e
Instruction ID: 5a4972f571b340f310a17f4c860637c7d02a2b0b33f874ad857eb5cc95741bcd
Opcode Fuzzy Hash: f6e11a59fce4ac53a83f3121a53598975f1015e7b274d191586ffc7bf631165e
Instruction Fuzzy Hash: 48414E30908780BEC7398B29D8A876A7B91BB46310F14403FE6A796761CB3199C2CB31

Function 00D52D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00D52D1B
GetDC.USER32(00000000), ref: 00D52D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D52D2E
ReleaseDC.USER32(00000000,00000000), ref: 00D52D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00D52D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00D52D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00D55A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00D52DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00D52DE1

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: af564550222b8aa90794dbf9c85b715517ba911e96df9fdadddf879368d23dd9
Instruction ID: 6db2f4a44f15289f1939e56c8db0cd47faced31a5edb65a1de173c836322fc30
Opcode Fuzzy Hash: af564550222b8aa90794dbf9c85b715517ba911e96df9fdadddf879368d23dd9
Instruction Fuzzy Hash: D9317A72211314AFEF118F548C8AFBB3BA9EB0A752F084055FE08DA2A1C6759844CBB0

Function 00D25622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00D25637
_memcmp.LIBVCRUNTIME ref: 00D25659
_memcmp.LIBVCRUNTIME ref: 00D25671
_memcmp.LIBVCRUNTIME ref: 00D25684
_memcmp.LIBVCRUNTIME ref: 00D2569E
_memcmp.LIBVCRUNTIME ref: 00D256B1
_memcmp.LIBVCRUNTIME ref: 00D256C9
_memcmp.LIBVCRUNTIME ref: 00D256E4

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: c88ee7c3414eae9cf2ac052b89563e82bcecb838f93ec2c3836a04d94a03ce2d
Instruction ID: 1409fc8db022cdff4cc4c966ec297ef63615447c52fc9d26f6e842657613efca
Opcode Fuzzy Hash: c88ee7c3414eae9cf2ac052b89563e82bcecb838f93ec2c3836a04d94a03ce2d
Instruction Fuzzy Hash: 1721AA716419657BD61496117D82FBB335CAF3138AF4C0030FD055E549F731ED2891B5

Function 00D44FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00D45007
NULL Pointer assignment, xrefs: 00D4502E, 00D45383

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 26727002bd31307fd2f0785571faee3f973585b9477abcf51383a3ea54c561f8
Instruction ID: a365845344f7180acb98337fabf0be459f26e3f1a8bb0ac96f83662fb5e11e66
Opcode Fuzzy Hash: 26727002bd31307fd2f0785571faee3f973585b9477abcf51383a3ea54c561f8
Instruction Fuzzy Hash: 88D1B075A0070AAFDF10CF98D884BAEB7B5BF48344F188069E915AB286D771DD45CBB0

Function 00D01522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00D015CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00D01651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00D016E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00D016FB

Part of subcall function 00CF3820: RtlAllocateHeap.NTDLL(00000000,?,00D91444,?,00CDFDF5,?,?,00CCA976,00000010,00D91440,00CC13FC,?,00CC13C6,?,00CC1129), ref: 00CF3852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00D01777
__freea.LIBCMT ref: 00D017A2
__freea.LIBCMT ref: 00D017AE

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 9b6183cfaf63a8ce47b8192b24c56b16acbbe89138da20bd4780ed5e852ef6ed
Instruction ID: c7070a5aff1f9b6a7f39c29fecbff2aa2fe565aa4b3481fab91f8131935c2f97
Opcode Fuzzy Hash: 9b6183cfaf63a8ce47b8192b24c56b16acbbe89138da20bd4780ed5e852ef6ed
Instruction Fuzzy Hash: 2E91A279E102169EDB208EA4CC85BEE7BB5EF89310F584659E909EB2C1DB35DC44CB70

Function 00D44523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D44648
VariantInit.OLEAUT32(?), ref: 00D44749
VariantClear.OLEAUT32(?), ref: 00D44753
VariantClear.OLEAUT32(?), ref: 00D447B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00D4472C
Null Object assignment in FOR..IN loop, xrefs: 00D445D8, 00D44706, 00D447BE

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 838863fd6a6b3c0ecd5060ba5d7cee2d25c5f1c70fff6de2df54c2784db4c773
Instruction ID: 9f59e261393de624a30d5065c0e1b573d7a89dce0175d580ba626680ab04d80f
Opcode Fuzzy Hash: 838863fd6a6b3c0ecd5060ba5d7cee2d25c5f1c70fff6de2df54c2784db4c773
Instruction Fuzzy Hash: BC917071A00219AFDF20CFA5C888FAEBBB8EF46715F148559F515AB280D7709985CFB0

Function 00D31187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00D3125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00D31284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00D312A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00D312D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00D3135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00D313C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00D31430

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 58e7f3c0e069bab1bd09a2c32bbb3d684ef7667733ba438a4d23377fc55c6e1b
Instruction ID: 39aea9b5861084de7fb6ef3ae9fa88449f020981d1f540198c1724d376399188
Opcode Fuzzy Hash: 58e7f3c0e069bab1bd09a2c32bbb3d684ef7667733ba438a4d23377fc55c6e1b
Instruction Fuzzy Hash: 1D91CE79A0030AAFDB00DFA8C885BBEB7B5FF44325F144029E951EB291D774A945CBB4

Function 00CD948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 32b3a5ac066e2eafdec4ac5cbbac48dd76d3bc191e4bf0b9e23c17295fd7ed16
Instruction ID: 708668e7c3494867f16057c70936ecb61feca5f21deb067a9a7acb7e5f3f1dee
Opcode Fuzzy Hash: 32b3a5ac066e2eafdec4ac5cbbac48dd76d3bc191e4bf0b9e23c17295fd7ed16
Instruction Fuzzy Hash: BE912775D00219EFCB10CFA9DC84AEEBBB8FF49320F14415AE915B7251D774AA42DB60

Function 00D43947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D4396B
CharUpperBuffW.USER32(?,?), ref: 00D43A7A
_wcslen.LIBCMT ref: 00D43A8A
VariantClear.OLEAUT32(?), ref: 00D43C1F

Part of subcall function 00D30CDF: VariantInit.OLEAUT32(00000000), ref: 00D30D1F
Part of subcall function 00D30CDF: VariantCopy.OLEAUT32(?,?), ref: 00D30D28
Part of subcall function 00D30CDF: VariantClear.OLEAUT32(?), ref: 00D30D34

Strings

AUTOIT.ERROR, xrefs: 00D43A80, 00D43A85
Incorrect Parameter format, xrefs: 00D439A6, 00D43BA1

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 04514157018e61b4157004c0dc2dc894e7c1ea0cf288ab85ec5818f96412dbb8
Instruction ID: ee1f633b6f2f31e24ab0e747e44d17ad1e780dcdfeb3c1c0a0f560b47dd37afc
Opcode Fuzzy Hash: 04514157018e61b4157004c0dc2dc894e7c1ea0cf288ab85ec5818f96412dbb8
Instruction Fuzzy Hash: E99157746083459FC704EF28C48596AB7E5FF88314F14892DF88A9B351DB31EE45CBA2

Function 00D44BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00D2000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00D1FF41,80070057,?,?,?,00D2035E), ref: 00D2002B
Part of subcall function 00D2000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00D1FF41,80070057,?,?), ref: 00D20046
Part of subcall function 00D2000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00D1FF41,80070057,?,?), ref: 00D20054
Part of subcall function 00D2000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00D1FF41,80070057,?), ref: 00D20064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00D44C51
_wcslen.LIBCMT ref: 00D44D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00D44DCF
CoTaskMemFree.OLE32(?), ref: 00D44DDA

Strings

NULL Pointer assignment, xrefs: 00D44E23, 00D44E52

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 6911ff1789b255cb841180a698a1a3356319a671366d8e94fe907f692c84f367
Instruction ID: 2c64369472007333a8d068124edbf88d985f98112b76ee63e3376158387a9e6e
Opcode Fuzzy Hash: 6911ff1789b255cb841180a698a1a3356319a671366d8e94fe907f692c84f367
Instruction Fuzzy Hash: F4910471D0021DAFDF14DFA4D891EEEBBB9FF08314F108169E915A7291EB309A449FA0

Function 00D520FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00D52183
GetMenuItemCount.USER32(00000000), ref: 00D521B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00D521DD
_wcslen.LIBCMT ref: 00D52213
GetMenuItemID.USER32(?,?), ref: 00D5224D
GetSubMenu.USER32(?,?), ref: 00D5225B

Part of subcall function 00D23A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00D23A57
Part of subcall function 00D23A3D: GetCurrentThreadId.KERNEL32 ref: 00D23A5E
Part of subcall function 00D23A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00D225B3), ref: 00D23A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00D522E3

Part of subcall function 00D2E97B: Sleep.KERNELBASE ref: 00D2E9F3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 356c4ef79ae725e983bf18305e778442f0b56971fb8bb46156b0e6dd903d1a3c
Instruction ID: 60391ed3bf93beb8f64dbd6fb049669bd5171dda9b87802c700f07cd90262266
Opcode Fuzzy Hash: 356c4ef79ae725e983bf18305e778442f0b56971fb8bb46156b0e6dd903d1a3c
Instruction Fuzzy Hash: 87717B75A00205AFCF14DFA8C881ABEB7F1EF49311F148459ED56EB351DB34EA498BA0

Function 00D57E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(011C52D8), ref: 00D57F37
IsWindowEnabled.USER32(011C52D8), ref: 00D57F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00D5801E
SendMessageW.USER32(011C52D8,000000B0,?,?), ref: 00D58051
IsDlgButtonChecked.USER32(?,?), ref: 00D58089
GetWindowLongW.USER32(011C52D8,000000EC), ref: 00D580AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00D580C3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 6f6e6d48fe773c4b73b8fdab8ec45e809549287c1cb43e1911f60be60afffb4e
Instruction ID: 0a9f93dcc805d97e4139c404d52c12d1ba4bb8105629a9e62a06b6ef62458f4b
Opcode Fuzzy Hash: 6f6e6d48fe773c4b73b8fdab8ec45e809549287c1cb43e1911f60be60afffb4e
Instruction Fuzzy Hash: 2C717C34608304AFEF21DF64D884FAABBB5EF09342F284459ED55973A1CB31A949DB30

Function 00D2AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00D2AEF9
GetKeyboardState.USER32(?), ref: 00D2AF0E
SetKeyboardState.USER32(?), ref: 00D2AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00D2AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00D2AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00D2AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00D2B020

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: a8057a9963ceca52f3b1660eb866c61e44f14635e936e03332d9a322661c0f05
Instruction ID: 9cccca0eaa47e9b8561d2fad0f63c74684ba54a802ac06c6a5c11c86524ff6b7
Opcode Fuzzy Hash: a8057a9963ceca52f3b1660eb866c61e44f14635e936e03332d9a322661c0f05
Instruction Fuzzy Hash: FB51C1A06047E53EFB3642389945BBABFE99F16318F0C848AF1E5954D2C3D8AC84D771

Function 00D2ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00D2AD19
GetKeyboardState.USER32(?), ref: 00D2AD2E
SetKeyboardState.USER32(?), ref: 00D2AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00D2ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00D2ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00D2AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00D2AE38

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 8419ac3ad92f644db039d7a6590e5c6a9fc75b4f634d607d9457c3320523a53b
Instruction ID: 66adfd66176f6c0b911be24455bd6da640ccb0fca51aa28eab2e13c39afe1eae
Opcode Fuzzy Hash: 8419ac3ad92f644db039d7a6590e5c6a9fc75b4f634d607d9457c3320523a53b
Instruction Fuzzy Hash: 8251E3A16047F13EFB3282289C55B7ABEA8DF56308F0C8489F1D5568C2D294EC89D772

Function 00CF542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00D03CD6,?,?,?,?,?,?,?,?,00CF5BA3,?,?,00D03CD6,?,?), ref: 00CF5470
__fassign.LIBCMT ref: 00CF54EB
__fassign.LIBCMT ref: 00CF5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00D03CD6,00000005,00000000,00000000), ref: 00CF552C
WriteFile.KERNEL32(?,00D03CD6,00000000,00CF5BA3,00000000,?,?,?,?,?,?,?,?,?,00CF5BA3,?), ref: 00CF554B
WriteFile.KERNEL32(?,?,00000001,00CF5BA3,00000000,?,?,?,?,?,?,?,?,?,00CF5BA3,?), ref: 00CF5584

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: bd98601249f803339d49cf46634caea652a9191393683fbcf9c8ee92bcbe9238
Instruction ID: 6d1908efc2c8b814a9d2663f485430cc0a2deee0af2a93c0153c2db489bc7c23
Opcode Fuzzy Hash: bd98601249f803339d49cf46634caea652a9191393683fbcf9c8ee92bcbe9238
Instruction Fuzzy Hash: 445190B1A00749AFDB11CFA8D885AEEBBF9EF09300F14415AFB55E7291D7309A41CB61

Function 00CE2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00CE2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00CE2D53
_ValidateLocalCookies.LIBCMT ref: 00CE2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00CE2E0C
_ValidateLocalCookies.LIBCMT ref: 00CE2E61

Strings

csm, xrefs: 00CE2DF6

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 11159bd4e92059ebadc47fbd60c5ec065ae23d199b8cb41fbc0937f9ea534106
Instruction ID: cdfc75d1cb8a5d8d490bef5d1fc4e583e5596c4dbeff3172f102a39ee82d7ff2
Opcode Fuzzy Hash: 11159bd4e92059ebadc47fbd60c5ec065ae23d199b8cb41fbc0937f9ea534106
Instruction Fuzzy Hash: 78417334A00299DBCF10DF6ACC45B9EBBA9BF45314F148155E914AB392D771AB05CBE0

Function 00D410B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00D4307A
Part of subcall function 00D4304E: _wcslen.LIBCMT ref: 00D4309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00D41112
WSAGetLastError.WSOCK32 ref: 00D41121
WSAGetLastError.WSOCK32 ref: 00D411C9
closesocket.WSOCK32(00000000), ref: 00D411F9

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 6e3745fada624a700eb6c8797158e26a373030b6effaf188e5401a853168a319
Instruction ID: 82110ae4e91c221279df731a162255f183047fa83c3f0a6dcdfd9586aeff2b4f
Opcode Fuzzy Hash: 6e3745fada624a700eb6c8797158e26a373030b6effaf188e5401a853168a319
Instruction Fuzzy Hash: 0C41DE35600304AFDB109F68C884BAABBA9EF45364F188059FD49AB391C770ED81CBB0

Function 00D2CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D2DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00D2CF22,?), ref: 00D2DDFD

Part of subcall function 00D2DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00D2CF22,?), ref: 00D2DE16

lstrcmpiW.KERNEL32(?,?), ref: 00D2CF45
MoveFileW.KERNEL32(?,?), ref: 00D2CF7F
_wcslen.LIBCMT ref: 00D2D005
_wcslen.LIBCMT ref: 00D2D01B
SHFileOperationW.SHELL32(?), ref: 00D2D061

Strings

\*.*, xrefs: 00D2CFF3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: e6b4805b2d7274b646e9ea2d969a6120402c360b19bb02ad4ccb838cad5ceb19
Instruction ID: 7b2e065449ff3576e636198415e727b52224ce2537c0b30aba892792b32fdecf
Opcode Fuzzy Hash: e6b4805b2d7274b646e9ea2d969a6120402c360b19bb02ad4ccb838cad5ceb19
Instruction Fuzzy Hash: 5141A7718062285FDF12EFA0DA81EDDB7B9EF18344F0400E6E545EB141EB34AA44CB70

Function 00D52DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00D52E1C
GetWindowLongW.USER32(?,000000F0), ref: 00D52E4F
GetWindowLongW.USER32(?,000000F0), ref: 00D52E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00D52EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00D52EE0
GetWindowLongW.USER32(?,000000F0), ref: 00D52EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D52F0B

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 034743d2180a1f5cca834ce3df46d164cfe1e636b51e30dfa0fa827be09594ce
Instruction ID: 8f3bd1b6ed62cc6f1f60ce1d121a1b7777755344a447f31144308aeaa52e0bb5
Opcode Fuzzy Hash: 034743d2180a1f5cca834ce3df46d164cfe1e636b51e30dfa0fa827be09594ce
Instruction Fuzzy Hash: 9A31F234604351AFDF218F58EC86F6537E1EB9A712F191165FD20CB2B1CB71A8489B61

Function 00D27726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D27769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D2778F
SysAllocString.OLEAUT32(00000000), ref: 00D27792
SysAllocString.OLEAUT32(?), ref: 00D277B0
SysFreeString.OLEAUT32(?), ref: 00D277B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00D277DE
SysAllocString.OLEAUT32(?), ref: 00D277EC

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 1d0e030eba9f094219973ecfc4fef6e7a5a96cc63eb48efdd05dc98f14094b04
Instruction ID: 27a8f7d99de4b961566500eab5606ac58fb87a0d7aec080a4ba813752ebdaadf
Opcode Fuzzy Hash: 1d0e030eba9f094219973ecfc4fef6e7a5a96cc63eb48efdd05dc98f14094b04
Instruction Fuzzy Hash: 11218E76604329AFDB20DFA8DC88CBB77ACFB19768B048025BE15DB250D670EC4187B0

Function 00D277FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D27842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D27868
SysAllocString.OLEAUT32(00000000), ref: 00D2786B
SysAllocString.OLEAUT32 ref: 00D2788C
SysFreeString.OLEAUT32 ref: 00D27895
StringFromGUID2.OLE32(?,?,00000028), ref: 00D278AF
SysAllocString.OLEAUT32(?), ref: 00D278BD

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 84a6346813518243ca93abeb220d3ac3712ebc6fa366f54803a3070760062969
Instruction ID: c15b17aa0facd9ece2e0f5c4375795e9d4d457d99044ae102fa4bed53b19c22f
Opcode Fuzzy Hash: 84a6346813518243ca93abeb220d3ac3712ebc6fa366f54803a3070760062969
Instruction Fuzzy Hash: A9217435608324AFDB209FA9DC88DAAB7ECEB197647148125F915CB2A1D670EC41CB74

Function 00D304D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00D304F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00D3052E

Strings

nul, xrefs: 00D30567

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: ddbca40f98b05aa99fbc3f934e3034277c0e6bdf01f4d15a0bd7b386406bc580
Instruction ID: 4b239251d760adcbf1c0f68aa55edd471bc53bc5c9cfc4220dd54b6b3d85bf4d
Opcode Fuzzy Hash: ddbca40f98b05aa99fbc3f934e3034277c0e6bdf01f4d15a0bd7b386406bc580
Instruction Fuzzy Hash: A7213975600305AFDB209F69DC54A9A7BB8AF44725F244A19FCA1E62E0E770D980CF30

Function 00D305A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00D305C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00D30601

Strings

nul, xrefs: 00D30639

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 63fea80016cb721a34e1a675a10fb9ec496948b8f101973ecb0256e3efe987b3
Instruction ID: 06a52c42835af30e7b47d218fa439ddc47e8740e27b1f1769f592bd2c8024bff
Opcode Fuzzy Hash: 63fea80016cb721a34e1a675a10fb9ec496948b8f101973ecb0256e3efe987b3
Instruction Fuzzy Hash: E72192755003059FDB209F69CC15A9A7BE8BF95B30F240A19FCA1E72E4D7709860CB34

Function 00D540AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00CC604C
Part of subcall function 00CC600E: GetStockObject.GDI32(00000011), ref: 00CC6060
Part of subcall function 00CC600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00CC606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00D54112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00D5411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00D5412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00D54139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00D54145

Strings

Msctls_Progress32, xrefs: 00D540E3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 3c6663fb59a2b1d188e0c6cd45242fac8bc56ed0775bb674f5ae5c3903e92ae2
Instruction ID: b9cabe07f193b29aba8e52d86e31ee89a94e62e3bc60a059c3bb61830a83c453
Opcode Fuzzy Hash: 3c6663fb59a2b1d188e0c6cd45242fac8bc56ed0775bb674f5ae5c3903e92ae2
Instruction Fuzzy Hash: 131190B215021ABEEF119E64CC85EE77F9DEF08798F104111BA18A2190C672DC619BB4

Function 00CFD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CFD7A3: _free.LIBCMT ref: 00CFD7CC

_free.LIBCMT ref: 00CFD82D

Part of subcall function 00CF29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00CFD7D1,00000000,00000000,00000000,00000000,?,00CFD7F8,00000000,00000007,00000000,?,00CFDBF5,00000000), ref: 00CF29DE
Part of subcall function 00CF29C8: GetLastError.KERNEL32(00000000,?,00CFD7D1,00000000,00000000,00000000,00000000,?,00CFD7F8,00000000,00000007,00000000,?,00CFDBF5,00000000,00000000), ref: 00CF29F0

_free.LIBCMT ref: 00CFD838
_free.LIBCMT ref: 00CFD843
_free.LIBCMT ref: 00CFD897
_free.LIBCMT ref: 00CFD8A2
_free.LIBCMT ref: 00CFD8AD
_free.LIBCMT ref: 00CFD8B8

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: c400212218748222acf8afd91bc486243862bf105f8251d3bcb0054b7303f51e
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: AE115171580B0CAAD5A1BFB0CC47FEB7BDD6F00700F400826B39AEA0A2DA65B6056652

Function 00D2DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00D2DA74
LoadStringW.USER32(00000000), ref: 00D2DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00D2DA91
LoadStringW.USER32(00000000), ref: 00D2DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00D2DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00D2DAB9

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 4758bac903d442176d62c972412ba125f6b5b86358aff25cf07d9c8986272190
Instruction ID: 6a880e01339e33890e1b0b7d74c12019a59796e9d7dd26da7b442ccdce690d01
Opcode Fuzzy Hash: 4758bac903d442176d62c972412ba125f6b5b86358aff25cf07d9c8986272190
Instruction Fuzzy Hash: A50162F25103187FE710ABA49D89EEB726CE718306F405491BB46E2141EA749E848F74

Function 00D3096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(011BE8F0,011BE8F0), ref: 00D3097B
EnterCriticalSection.KERNEL32(011BE8D0,00000000), ref: 00D3098D
TerminateThread.KERNEL32(?,000001F6), ref: 00D3099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00D309A9
CloseHandle.KERNEL32(?), ref: 00D309B8
InterlockedExchange.KERNEL32(011BE8F0,000001F6), ref: 00D309C8
LeaveCriticalSection.KERNEL32(011BE8D0), ref: 00D309CF

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 0bc305b87454643f11019823c1916cc276c3f8ac05b7b6050be5a920e47a6b08
Instruction ID: 61b76563169fd062289229672b2db7c57e33fd153ed1d24f81555d5d20d98af5
Opcode Fuzzy Hash: 0bc305b87454643f11019823c1916cc276c3f8ac05b7b6050be5a920e47a6b08
Instruction Fuzzy Hash: 2CF01932552B02AFD7415BA4EE88BDABA29FF01702F442025F602909A0CB7494A5CFB4

Function 00CC5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00CC5D30
GetWindowRect.USER32(?,?), ref: 00CC5D71
ScreenToClient.USER32(?,?), ref: 00CC5D99
GetClientRect.USER32(?,?), ref: 00CC5ED7
GetWindowRect.USER32(?,?), ref: 00CC5EF8

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 3812ce1ad4b0ebb782c38d09d0d42f9aaa2a0501bfd8ca1f82687490fc74d197
Instruction ID: 527bbe399809af74fb72412a10dd1f7cfc28ab0e36f1d841ffef4248455ed892
Opcode Fuzzy Hash: 3812ce1ad4b0ebb782c38d09d0d42f9aaa2a0501bfd8ca1f82687490fc74d197
Instruction Fuzzy Hash: 9BB16D74A0074ADBDB14CFA9C440BEAB7F1FF54310F14941EE8A9D7290DB34AA91DB60

Function 00CF01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00CF00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CF00D6
__allrem.LIBCMT ref: 00CF00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CF010B
__allrem.LIBCMT ref: 00CF0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CF0140

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 7bad521b8578de0ba09b1ac61b7d53d2d81427b63e854a32f92ce186e78e15ad
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: A6810872600B0A9BE7249F69CC42B7E73E9EF41724F24853EF625D6282EB70DE019751

Function 00D41D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D43149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,00D4101C,00000000,?,?,00000000), ref: 00D43195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00D41DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00D41DE1
WSAGetLastError.WSOCK32 ref: 00D41DF2
inet_ntoa.WSOCK32(?), ref: 00D41E8C
htons.WSOCK32(?,?,?,?,?), ref: 00D41EDB
_strlen.LIBCMT ref: 00D41F35

Part of subcall function 00D239E8: _strlen.LIBCMT ref: 00D239F2

Part of subcall function 00CC6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00CDCF58,?,?,?), ref: 00CC6DBA
Part of subcall function 00CC6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00CDCF58,?,?,?), ref: 00CC6DED

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 89e5488bb967f4c0bdca4392baef8af0e0ec1f5b02c692fff946feb75ef69164
Instruction ID: b6bce577ccf0ffbf7e9cd94e2b4d58505418fc6de32fc8304b78301023c86874
Opcode Fuzzy Hash: 89e5488bb967f4c0bdca4392baef8af0e0ec1f5b02c692fff946feb75ef69164
Instruction Fuzzy Hash: 28A1C175504341AFC324DF24C895F2ABBE5AF84318F58895CF4965B2E2CB31ED86CBA1

Function 00CF61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00CE82D9,00CE82D9,?,?,?,00CF644F,00000001,00000001,8BE85006), ref: 00CF6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00CF644F,00000001,00000001,8BE85006,?,?,?), ref: 00CF62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00CF63D8
__freea.LIBCMT ref: 00CF63E5

Part of subcall function 00CF3820: RtlAllocateHeap.NTDLL(00000000,?,00D91444,?,00CDFDF5,?,?,00CCA976,00000010,00D91440,00CC13FC,?,00CC13C6,?,00CC1129), ref: 00CF3852

__freea.LIBCMT ref: 00CF63EE
__freea.LIBCMT ref: 00CF6413

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 164c4d5dd47ce37e4da47a0042b1b5740e72e1c3c1017172982aad365de23a64
Instruction ID: 7b6126d06df06e7cc0c3f6a9300190fe15f2d7be1baded83bb7fc52818554c87
Opcode Fuzzy Hash: 164c4d5dd47ce37e4da47a0042b1b5740e72e1c3c1017172982aad365de23a64
Instruction Fuzzy Hash: 5551027260021AABEB258F64CC81EBF7BA9EB44710F154229FF15D7150DB34DD48D6A2

Function 00D4BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

Part of subcall function 00D4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D4B6AE,?,?), ref: 00D4C9B5
Part of subcall function 00D4C998: _wcslen.LIBCMT ref: 00D4C9F1
Part of subcall function 00D4C998: _wcslen.LIBCMT ref: 00D4CA68
Part of subcall function 00D4C998: _wcslen.LIBCMT ref: 00D4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D4BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D4BD25
RegCloseKey.ADVAPI32(00000000), ref: 00D4BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00D4BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00D4BDF3
RegCloseKey.ADVAPI32(?), ref: 00D4BDFF

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 89c4ed80644af3f0604c986c223097f41939b24fb321961824eab1c4908ae3dc
Instruction ID: 9e691ca4b521270577a438e90a8f115a0609d81929eaa4ac2cc0681e4e5b2a59
Opcode Fuzzy Hash: 89c4ed80644af3f0604c986c223097f41939b24fb321961824eab1c4908ae3dc
Instruction Fuzzy Hash: 31819F30118341AFC714DF24C885E2ABBE5FF84318F14859DF5968B2A2DB31ED45DBA2

Function 00D1F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00D1F7B9
SysAllocString.OLEAUT32(00000001), ref: 00D1F860
VariantCopy.OLEAUT32(00D1FA64,00000000), ref: 00D1F889
VariantClear.OLEAUT32(00D1FA64), ref: 00D1F8AD
VariantCopy.OLEAUT32(00D1FA64,00000000), ref: 00D1F8B1
VariantClear.OLEAUT32(?), ref: 00D1F8BB

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: c5ec7b6e922230f53b3dc608484c4d2b0641827c8d7fcb25c5f2505d71de28f2
Instruction ID: 0aea15e3dd48411ef413b665e7eb8fe87d05d88742f50c7b885ef417e322cbed
Opcode Fuzzy Hash: c5ec7b6e922230f53b3dc608484c4d2b0641827c8d7fcb25c5f2505d71de28f2
Instruction Fuzzy Hash: A851B431600310BACF24AB65E895BADB3A5EF45710F24946BE906DF291DF709C80DBB6

Function 00D3910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00CC7620: _wcslen.LIBCMT ref: 00CC7625

Part of subcall function 00CC6B57: _wcslen.LIBCMT ref: 00CC6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00D394E5
_wcslen.LIBCMT ref: 00D39506
_wcslen.LIBCMT ref: 00D3952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00D39585

Strings

X, xrefs: 00D39412

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 408ab0e555890bab6ae89f28f3fa6b52afe5181cc2a0420d48ce480985d73a7e
Instruction ID: f77bc802153b7431efd682e02197299c032179fa7565a122c6abc13b405ba24b
Opcode Fuzzy Hash: 408ab0e555890bab6ae89f28f3fa6b52afe5181cc2a0420d48ce480985d73a7e
Instruction Fuzzy Hash: DFE18E716083419FC714DF24C891F6AB7E4BF85314F08896DE8899B3A2DB71DD45CBA2

Function 00CD920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00CD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00CD9BB2

BeginPaint.USER32(?,?,?), ref: 00CD9241
GetWindowRect.USER32(?,?), ref: 00CD92A5
ScreenToClient.USER32(?,?), ref: 00CD92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00CD92D3
EndPaint.USER32(?,?,?,?,?), ref: 00CD9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00D171EA

Part of subcall function 00CD9339: BeginPath.GDI32(00000000), ref: 00CD9357

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 23628e28a3eb49d1b42b434a1c7981f368d69438a7835b5e00ee7e8c925f4412
Instruction ID: 2265e5e65e5ed3821a0b1ab26e36291b7087c9c08327aa90f158a821e8ac90d1
Opcode Fuzzy Hash: 23628e28a3eb49d1b42b434a1c7981f368d69438a7835b5e00ee7e8c925f4412
Instruction Fuzzy Hash: C441AB74108301AFD711DF25D884FAA7BB8EB49321F04062AFAA4C73B1C7309985DB71

Function 00D307EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00D3080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00D30847
EnterCriticalSection.KERNEL32(?), ref: 00D30863
LeaveCriticalSection.KERNEL32(?), ref: 00D308DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00D308F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00D30921

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 5e6e44eb01711a940206163398d522a0ac85d39bd732e0fa2c1967996625c2f5
Instruction ID: 555f8cf68e4250ae1c1a28c856840deb34fc83195afa1262652c6dbcdb566f9f
Opcode Fuzzy Hash: 5e6e44eb01711a940206163398d522a0ac85d39bd732e0fa2c1967996625c2f5
Instruction Fuzzy Hash: 7B414771900305AFDF14AF54DC85A6ABBB9FF04310F1440A9ED05DA296DB30DE65DBB4

Function 00D581DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00D1F3AB,00000000,?,?,00000000,?,00D1682C,00000004,00000000,00000000), ref: 00D5824C
EnableWindow.USER32(?,00000000), ref: 00D58272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00D582D1
ShowWindow.USER32(?,00000004), ref: 00D582E5
EnableWindow.USER32(?,00000001), ref: 00D5830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00D5832F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: b87e0fa88904462bb4c4511ddfc7a35d0e834a26446d21b227ac63ee45fc6458
Instruction ID: db645cc254412e60598b38a0782485713662c16691850b0041303b7c8032aed1
Opcode Fuzzy Hash: b87e0fa88904462bb4c4511ddfc7a35d0e834a26446d21b227ac63ee45fc6458
Instruction Fuzzy Hash: C041A134601740AFDF12CF14C899BA47BE0BB0A716F185169ED18DB262CB31A849DF74

Function 00D24C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00D24C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00D24CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00D24CEA
_wcslen.LIBCMT ref: 00D24D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00D24D10
_wcsstr.LIBVCRUNTIME ref: 00D24D1A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 042c6c470f0872c648dda58bed7c23a5283fdbb2edb7032494836a35e918b6a0
Instruction ID: b2c9ab511f76701a980758355daa5400a5fcc4a07eaafdffafe90e550d73e1c1
Opcode Fuzzy Hash: 042c6c470f0872c648dda58bed7c23a5283fdbb2edb7032494836a35e918b6a0
Instruction Fuzzy Hash: B321D7312043107BEB155B39AC49E7B7B9CDF55754F14406AFD05CA2A2DA61DD01A6B0

Function 00D3581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00CC3A97,?,?,00CC2E7F,?,?,?,00000000), ref: 00CC3AC2

_wcslen.LIBCMT ref: 00D3587B
CoInitialize.OLE32(00000000), ref: 00D35995
CoCreateInstance.OLE32(00D5FCF8,00000000,00000001,00D5FB68,?), ref: 00D359AE
CoUninitialize.OLE32 ref: 00D359CC

Strings

.lnk, xrefs: 00D35876, 00D358C1, 00D35985

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: bc377cb916cede6e8a043108aad7c9b8b3ae5da6b9c610eb75deff6d7b3a3fee
Instruction ID: 79588299726b8322cf9ae998ea5d90f3762d7b91c283bc846c458d27e127b778
Opcode Fuzzy Hash: bc377cb916cede6e8a043108aad7c9b8b3ae5da6b9c610eb75deff6d7b3a3fee
Instruction Fuzzy Hash: DBD150716087019FC714DF24D484A2ABBE5EF89720F18895DF88A9B361DB31ED45CFA2

Function 00D2175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D20FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00D20FCA
Part of subcall function 00D20FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00D20FD6
Part of subcall function 00D20FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00D20FE5
Part of subcall function 00D20FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00D20FEC
Part of subcall function 00D20FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00D21002

GetLengthSid.ADVAPI32(?,00000000,00D21335), ref: 00D217AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00D217BA
HeapAlloc.KERNEL32(00000000), ref: 00D217C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00D217DA
GetProcessHeap.KERNEL32(00000000,00000000,00D21335), ref: 00D217EE
HeapFree.KERNEL32(00000000), ref: 00D217F5

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: ec0702ce1572a7f7e464aa853415717579445cfd94da9e01301de02ac455a623
Instruction ID: 8a8d57ffc2e99947e054285279b795373a57243a080ff2189d7d0558532451e8
Opcode Fuzzy Hash: ec0702ce1572a7f7e464aa853415717579445cfd94da9e01301de02ac455a623
Instruction Fuzzy Hash: 2811AC35610715EFDB109FA4EC49FAE7BA9FBA535AF148018F881D7211CB35A944CBB0

Function 00D214CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00D214FF
OpenProcessToken.ADVAPI32(00000000), ref: 00D21506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00D21515
CloseHandle.KERNEL32(00000004), ref: 00D21520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00D2154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00D21563

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 9708e93d8d230351beb16d31f1a6357a7dd4ebfe3f7bf556101ddfdc1864c1c8
Instruction ID: b0830ac5c02955a79a0fb51cae329fb8ee280dab8c6035a4580620b6bca7c8d2
Opcode Fuzzy Hash: 9708e93d8d230351beb16d31f1a6357a7dd4ebfe3f7bf556101ddfdc1864c1c8
Instruction Fuzzy Hash: 5511447650030DAFDB118FA8ED49BDE7BA9EB58749F088064FE15A21A0C371CE61DB70

Function 00CE3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00CE3379,00CE2FE5), ref: 00CE3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00CE339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00CE33B7
SetLastError.KERNEL32(00000000,?,00CE3379,00CE2FE5), ref: 00CE3409

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: b499cfac38619b43d01b9558862059d9422be2a8fa3524e60839b68e9408b5fe
Instruction ID: 8eebe40e994a715115e40ab8376910fe809fb62265b3292739224534eb84306d
Opcode Fuzzy Hash: b499cfac38619b43d01b9558862059d9422be2a8fa3524e60839b68e9408b5fe
Instruction Fuzzy Hash: AE012D322283D1BFA71527777C8DA6A1A5CE7053B67300229F520C32F0EF616F026674

Function 00CF2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00CF5686,00D03CD6,?,00000000,?,00CF5B6A,?,?,?,?,?,00CEE6D1,?,00D88A48), ref: 00CF2D78
_free.LIBCMT ref: 00CF2DAB
_free.LIBCMT ref: 00CF2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00CEE6D1,?,00D88A48,00000010,00CC4F4A,?,?,00000000,00D03CD6), ref: 00CF2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00CEE6D1,?,00D88A48,00000010,00CC4F4A,?,?,00000000,00D03CD6), ref: 00CF2DEC
_abort.LIBCMT ref: 00CF2DF2

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 8c66cb7b16cdbd05cebd31254e8d92193a4dd1f0e59fdc531bb824f047316e60
Instruction ID: f49cd8f718309f0825ae7d3a14a8216cbfe4aa9746f41a6ee7de1716cfaef179
Opcode Fuzzy Hash: 8c66cb7b16cdbd05cebd31254e8d92193a4dd1f0e59fdc531bb824f047316e60
Instruction Fuzzy Hash: F1F0F432645B0C6BC2922734BC0AA7A2559AFC1BA1B200018FB34D22E2EF248A01A133

Function 00D58A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00CD9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00CD9693
Part of subcall function 00CD9639: SelectObject.GDI32(?,00000000), ref: 00CD96A2
Part of subcall function 00CD9639: BeginPath.GDI32(?), ref: 00CD96B9
Part of subcall function 00CD9639: SelectObject.GDI32(?,00000000), ref: 00CD96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00D58A4E
LineTo.GDI32(?,00000003,00000000), ref: 00D58A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00D58A70
LineTo.GDI32(?,00000000,00000003), ref: 00D58A80
EndPath.GDI32(?), ref: 00D58A90
StrokePath.GDI32(?), ref: 00D58AA0

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 9a0e52aa41ff02e549c0cce46c8393d3654c8508b1d87b381be2feb5b9a103c2
Instruction ID: b6d67d10de76f027272905b5bfc4f077c1c0832e9d5d0da8402659ed98cb0492
Opcode Fuzzy Hash: 9a0e52aa41ff02e549c0cce46c8393d3654c8508b1d87b381be2feb5b9a103c2
Instruction Fuzzy Hash: 6F11A576000349FFDB129F94DC88EAA7F6DEB08395F048012BE199A2A1C7729D559BB0

Function 00D251FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D25218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00D25229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D25230
ReleaseDC.USER32(00000000,00000000), ref: 00D25238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00D2524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00D25261

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 532e7ae1720ece29516bd63008cec3b3ee7cd0e460e467929b0d449038bcf905
Instruction ID: fd4a3d1a01433af7c51ede2f9d314021ccaf87c61d8043e23251da32e455fe64
Opcode Fuzzy Hash: 532e7ae1720ece29516bd63008cec3b3ee7cd0e460e467929b0d449038bcf905
Instruction Fuzzy Hash: C0014F75A40718BFEB109BA5AC49E5EBFB8EF48752F044065FA04E7391DA709900CBB0

Function 00CC1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00CC1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00CC1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00CC1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00CC1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00CC1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CC1C22

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 2aee14acb1e806f2e37c608c0f6652c737f5c9b63e0bcc3744e30c2a6380b881
Instruction ID: d4b336feaaf85c4da9e2d0a457b04984e6a0d00a877e5da8fd47e47c36f1455c
Opcode Fuzzy Hash: 2aee14acb1e806f2e37c608c0f6652c737f5c9b63e0bcc3744e30c2a6380b881
Instruction Fuzzy Hash: 22016CB09027597DE3008F5A8C85B52FFA8FF19354F00411B915C47A41C7F5A864CBE5

Function 00D2EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00D2EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00D2EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00D2EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D2EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D2EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D2EB75

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 596f3bae37716048b6c568547822a1acff380583b0d4e4df63dbc9bf7430145d
Instruction ID: 9392ebd642090b8226c7941569d4191538e85ffc6916949045ea9cda8a31526b
Opcode Fuzzy Hash: 596f3bae37716048b6c568547822a1acff380583b0d4e4df63dbc9bf7430145d
Instruction Fuzzy Hash: F8F03072250758BFE72157529C0DEEF3E7CEFCAB12F001158FA11D1291D7A05A01C6B5

Function 00D17439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00D17452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00D17469
GetWindowDC.USER32(?), ref: 00D17475
GetPixel.GDI32(00000000,?,?), ref: 00D17484
ReleaseDC.USER32(?,00000000), ref: 00D17496
GetSysColor.USER32(00000005), ref: 00D174B0

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 54bb4fdee8c89d4de3f37e34f3ff850546ea2ee8d5c696260a664c40010a37e3
Instruction ID: f026bbebc80e465c04dc6eebe3c1289303e82640f63bcef531799d19aa11d34e
Opcode Fuzzy Hash: 54bb4fdee8c89d4de3f37e34f3ff850546ea2ee8d5c696260a664c40010a37e3
Instruction Fuzzy Hash: F7011231414315FFEB515BA4EC48BAA7BB5FB04322F651164FE16A22B1CB311E91EB60

Function 00D21874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00D2187F
UnloadUserProfile.USERENV(?,?), ref: 00D2188B
CloseHandle.KERNEL32(?), ref: 00D21894
CloseHandle.KERNEL32(?), ref: 00D2189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00D218A5
HeapFree.KERNEL32(00000000), ref: 00D218AC

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: b92ce89168434dc45cc2a91a9283663e47baf0b0108ef15101f2f2b026a92302
Instruction ID: 7b05503c53907cce02cf027a390ba37de8e52ede7b4cee0e7a7afb78e0ab10f9
Opcode Fuzzy Hash: b92ce89168434dc45cc2a91a9283663e47baf0b0108ef15101f2f2b026a92302
Instruction Fuzzy Hash: 6CE0C236114705BFEA015BA1ED0CD0ABB69FB59B22B109220FA26C1670CB32A4A0DB60

Function 00D2C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC7620: _wcslen.LIBCMT ref: 00CC7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00D2C6EE
_wcslen.LIBCMT ref: 00D2C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00D2C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00D2C7CA

Strings

0, xrefs: 00D2C6AF

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 20e57695e24a6d4213d0e42b166ed4057f1d1078a5a724a733449275ce7f8b10
Instruction ID: 428a1f429775563ab5eb22ef780308e4f44e89f7e2abbaa50bf816a9dfb152a5
Opcode Fuzzy Hash: 20e57695e24a6d4213d0e42b166ed4057f1d1078a5a724a733449275ce7f8b10
Instruction Fuzzy Hash: 9751F3716243219BD7149F28E844B6F77E8AF65318F082A2DF995D32A0DB70DD04DB72

Function 00D4AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00D4AEA3

Part of subcall function 00CC7620: _wcslen.LIBCMT ref: 00CC7625

GetProcessId.KERNEL32(00000000), ref: 00D4AF38
CloseHandle.KERNEL32(00000000), ref: 00D4AF67

Strings

<, xrefs: 00D4AE6B
@, xrefs: 00D4AE72

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: f0b02dc47e20d2a862bb95d0333e5a281b62ffe0342bb70d35dd99df67ebac96
Instruction ID: 0e1b676630711aa9d950d00a33f21eb5e8b4eef4b200a672927cf8f016f2b938
Opcode Fuzzy Hash: f0b02dc47e20d2a862bb95d0333e5a281b62ffe0342bb70d35dd99df67ebac96
Instruction Fuzzy Hash: E2713671A00619DFCB14DF98C484A9EBBF0EF08314F0484ADE856AB3A2C774ED45DBA1

Function 00D2719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00D27206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00D2723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00D2724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00D272CF

Strings

DllGetClassObject, xrefs: 00D27242

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 2e6d3afcdd86d616d19c5a011863732f8a2f9681495eae3b0fe61758887b3ea5
Instruction ID: fccb8bf726e7c04c6e8e22f5412ad27a6614950deb32e8604404e26a339dabc2
Opcode Fuzzy Hash: 2e6d3afcdd86d616d19c5a011863732f8a2f9681495eae3b0fe61758887b3ea5
Instruction Fuzzy Hash: 5E418AB1A04324EFDB25CF54D884A9A7BA9EF54318F2480ADFD059F20AD7B1D944CBB4

Function 00D53D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D53E35
IsMenu.USER32(?), ref: 00D53E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00D53E92
DrawMenuBar.USER32 ref: 00D53EA5

Strings

0, xrefs: 00D53D89

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 9cfc339220230896c1d94e98049b8eee5efeb7fc5b05ed4772b429b7000d1458
Instruction ID: 92265fe298463ae4ca9a3040cfe1e6816e94c2b9c3891ea3436ba9d23689694c
Opcode Fuzzy Hash: 9cfc339220230896c1d94e98049b8eee5efeb7fc5b05ed4772b429b7000d1458
Instruction Fuzzy Hash: 734135B5A00249AFDF10DF90D885AAABBF9BB48395F084229FD1597250D730AE48CF60

Function 00D21DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

Part of subcall function 00D23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00D23CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00D21E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00D21E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00D21EA9

Part of subcall function 00CC6B57: _wcslen.LIBCMT ref: 00CC6B6A

Strings

ComboBox, xrefs: 00D21DF0
ListBox, xrefs: 00D21E25

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 339cc684b4216e6d12ebe43ccfc93796f7051bcdab01f90ecb2a4989752ff39b
Instruction ID: 1d51a240752442f16003ed944fe1b2243bb71eb64168625916fc777a26860125
Opcode Fuzzy Hash: 339cc684b4216e6d12ebe43ccfc93796f7051bcdab01f90ecb2a4989752ff39b
Instruction Fuzzy Hash: 6D213575A00204BEDB14AB60EC59DFFB7B8EF61354B14812DF825A32E0DB344E0AA630

Function 00D4C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D4C9F1
_wcslen.LIBCMT ref: 00D4CA68
_wcslen.LIBCMT ref: 00D4CA9E
_wcslen.LIBCMT ref: 00D4CAF9
_wcslen.LIBCMT ref: 00D4CB2F
_wcslen.LIBCMT ref: 00D4CB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 00D4CA62, 00D4CA67
HKLM, xrefs: 00D4CA98, 00D4CA9D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 17fcfc6eccca2adb496a7624070d1413e2593723065d861371d42e976f8df429
Instruction ID: adafe5ff4d87dce461010dcbf46faf1ce936448e7e013e279b60dae3db589014
Opcode Fuzzy Hash: 17fcfc6eccca2adb496a7624070d1413e2593723065d861371d42e976f8df429
Instruction Fuzzy Hash: 3B313733A2216A4BCB60EF2CC8425BF33A19BA1750F1D5029E841AB345FA71CE44D3B0

Function 00D52F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00D52F8D
LoadLibraryW.KERNEL32(?), ref: 00D52F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00D52FA9
DestroyWindow.USER32(?), ref: 00D52FB1

Strings

SysAnimate32, xrefs: 00D52F68

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 0097e09066f19cb07f3c8cf6ecde6576b1a11dd3fe633f33c856868df5d37241
Instruction ID: 5bf12047d21bebf2142ebb1cc3a2ee8f8db0262181a37e46e2456bd581441d0d
Opcode Fuzzy Hash: 0097e09066f19cb07f3c8cf6ecde6576b1a11dd3fe633f33c856868df5d37241
Instruction Fuzzy Hash: EF218872204205AFEF104F66EC80EBB37B9EF6A366F140218FE50E61A0D671DC599B70

Function 00CE4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00CE4D1E,00CF28E9,?,00CE4CBE,00CF28E9,00D888B8,0000000C,00CE4E15,00CF28E9,00000002), ref: 00CE4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00CE4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00CE4D1E,00CF28E9,?,00CE4CBE,00CF28E9,00D888B8,0000000C,00CE4E15,00CF28E9,00000002,00000000), ref: 00CE4DC3

Strings

CorExitProcess, xrefs: 00CE4D98
mscoree.dll, xrefs: 00CE4D86

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 382e85b947dda2b1c2f5b4b1dfa8e50d78b9855777c81370ea7dbf0947651087
Instruction ID: e116cb8e2de5d9afbc4654692c3bf6483a67fc14e9f793433171401aaf591cc1
Opcode Fuzzy Hash: 382e85b947dda2b1c2f5b4b1dfa8e50d78b9855777c81370ea7dbf0947651087
Instruction Fuzzy Hash: 84F03C34A50308AFDB159F91DC49BAEBFA5EB44752F0000A4A805E2260CB705A44DBE0

Function 00D1D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00D1D3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00D1D3BF
FreeLibrary.KERNEL32(00000000), ref: 00D1D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00D1D3B9
X64, xrefs: 00D1D2A8

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 3a37a012752141d9b8e13f4c1c72506ff7403d13c49848d478c2970c4565c794
Instruction ID: cbed5593b6e7e1447f5c2d696a0032cf3cbfcc52fd336efbec705bd17c86262a
Opcode Fuzzy Hash: 3a37a012752141d9b8e13f4c1c72506ff7403d13c49848d478c2970c4565c794
Instruction Fuzzy Hash: B3F05575816B21BFDB741B10AC98DE93326AF11703B58910AFC52E1200DFB0CCC486B6

Function 00CC4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00CC4EDD,?,00D91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00CC4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00CC4EAE
FreeLibrary.KERNEL32(00000000,?,?,00CC4EDD,?,00D91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00CC4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00CC4EA8
kernel32.dll, xrefs: 00CC4E94

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: a3e08192d64589e98c55e76d8bc59dd5e3a767cc61870ba53964d47213b936bb
Instruction ID: 7275ffbd160f7dbd70f8c014f721ab7733f6f98e2c569323d607ebf54bb0258d
Opcode Fuzzy Hash: a3e08192d64589e98c55e76d8bc59dd5e3a767cc61870ba53964d47213b936bb
Instruction Fuzzy Hash: F3E08C36E12B225F92222B25AC28F6BA658AF81F63B06411DFC04E2240DB60CE0581B1

Function 00CC4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00D03CDE,?,00D91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00CC4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00CC4E74
FreeLibrary.KERNEL32(00000000,?,?,00D03CDE,?,00D91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00CC4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00CC4E6E
kernel32.dll, xrefs: 00CC4E5B

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 918d6646d88124eed1284748567e00e5b50ad58495fd0f726ebe3713e71b09ce
Instruction ID: 8fa4c2a7e4f51453479290c876d6ac883dae3925cf3025ee1f7e25f866d89a0d
Opcode Fuzzy Hash: 918d6646d88124eed1284748567e00e5b50ad58495fd0f726ebe3713e71b09ce
Instruction Fuzzy Hash: F8D01235512B215F5A261B29BC28E9BAA18AF85F52306551DFD15E2215CF60CE05C5F0

Function 00D32947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00D32C05
DeleteFileW.KERNEL32(?), ref: 00D32C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00D32C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00D32CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00D32CC0

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: a77f2ad64a7d156d61f9e196565f418a4c8f538d8b9c5fa1f08a5916936646cd
Instruction ID: 94730052a1255ee78bf6083b2ccd109487474169c233dcb3b6eee4956177c9c8
Opcode Fuzzy Hash: a77f2ad64a7d156d61f9e196565f418a4c8f538d8b9c5fa1f08a5916936646cd
Instruction Fuzzy Hash: A6B15E72D01219ABDF21DFA4CC85EEEB77DEF48350F1040AAF609E6145EA31AA449F71

Function 00D4A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00D4A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00D4A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00D4A468
CloseHandle.KERNEL32(?), ref: 00D4A63D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 55a95581c03c32c626955645fa36e74bc5b7b780c6e400591376c6044b7921e5
Instruction ID: b9b75549241e0ab07b6fab53229bfb8d54f0a25ea3fa9bc323fba635bdf087bb
Opcode Fuzzy Hash: 55a95581c03c32c626955645fa36e74bc5b7b780c6e400591376c6044b7921e5
Instruction Fuzzy Hash: A6A190716447019FD720DF28C886F2AB7E5AF84714F18885DF99A9B3D2D7B0EC418B92

Function 00D2E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D2DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00D2CF22,?), ref: 00D2DDFD

Part of subcall function 00D2DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00D2CF22,?), ref: 00D2DE16

Part of subcall function 00D2E199: GetFileAttributesW.KERNEL32(?,00D2CF95), ref: 00D2E19A

lstrcmpiW.KERNEL32(?,?), ref: 00D2E473
MoveFileW.KERNEL32(?,?), ref: 00D2E4AC
_wcslen.LIBCMT ref: 00D2E5EB
_wcslen.LIBCMT ref: 00D2E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00D2E650

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 63728d54a26ee805fce7f9cc1cdcfe437305b46562f544e308c0349865a69afe
Instruction ID: 2a532da871efdf41730a1e2d82c0f13db47784fcdfd33dc5a330207a12f4b45b
Opcode Fuzzy Hash: 63728d54a26ee805fce7f9cc1cdcfe437305b46562f544e308c0349865a69afe
Instruction Fuzzy Hash: B65160B24083955BC724EB90D881ADFB3ECEF95344F04492EF689D3191EE74E6888776

Function 00D4B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

Part of subcall function 00D4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D4B6AE,?,?), ref: 00D4C9B5
Part of subcall function 00D4C998: _wcslen.LIBCMT ref: 00D4C9F1
Part of subcall function 00D4C998: _wcslen.LIBCMT ref: 00D4CA68
Part of subcall function 00D4C998: _wcslen.LIBCMT ref: 00D4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D4BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D4BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00D4BB63
RegCloseKey.ADVAPI32(?,?), ref: 00D4BBA6
RegCloseKey.ADVAPI32(00000000), ref: 00D4BBB3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 287015c4ac23de577f2a3d85e4176757dad0865c17c6c7e788d1617657221345
Instruction ID: c59bd79e2dab6e7629920539a025afd82be262c5d12824457acbd8cc82284d66
Opcode Fuzzy Hash: 287015c4ac23de577f2a3d85e4176757dad0865c17c6c7e788d1617657221345
Instruction Fuzzy Hash: 45619131208341AFD714DF14C895E2ABBE5FF84318F18855DF4998B2A2DB31ED45DBA2

Function 00D28BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D28BCD
VariantClear.OLEAUT32 ref: 00D28C3E
VariantClear.OLEAUT32 ref: 00D28C9D
VariantClear.OLEAUT32(?), ref: 00D28D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00D28D3B

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 190e630fdfb31c8caaa815cee0bb062d9dc0d05942fcff5306a5c95e98aa0ef7
Instruction ID: 710f1792b5d89a1ceca7dc2facf2ba1b7dc6feb39df5e48185bcd4ec8c58e968
Opcode Fuzzy Hash: 190e630fdfb31c8caaa815cee0bb062d9dc0d05942fcff5306a5c95e98aa0ef7
Instruction Fuzzy Hash: 445169B5A01219EFDB10CF68D884EAAB7F8FF99314B158559E905DB350E730E911CFA0

Function 00D38AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00D38BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00D38BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00D38C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00D38C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00D38C5F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 13d3afd15777f570fd738a32f0a17ac7687f366dcadb3cb107f62a0198919f69
Instruction ID: f21cb954bb23c4ce49ea627b42ae1049fd058dd5779102467a31e8e7cc68f8a0
Opcode Fuzzy Hash: 13d3afd15777f570fd738a32f0a17ac7687f366dcadb3cb107f62a0198919f69
Instruction Fuzzy Hash: DD512935A002159FCB05DF64C881E69BBF5FF48314F088459E849AB362DB35ED51EFA0

Function 00D48EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00D48F40
GetProcAddress.KERNEL32(00000000,?), ref: 00D48FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00D48FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00D49032
FreeLibrary.KERNEL32(00000000), ref: 00D49052

Part of subcall function 00CDF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00D31043,?,753CE610), ref: 00CDF6E6
Part of subcall function 00CDF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00D1FA64,00000000,00000000,?,?,00D31043,?,753CE610,?,00D1FA64), ref: 00CDF70D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: e5cde2d5f05217d266b741939cbacd7a860d239e7d55cf777d24420c5dc3c9c9
Instruction ID: 6daf82d515899d47eb7402b4b5cad6a8cd3705174efe09e7cb13d0040e2be27c
Opcode Fuzzy Hash: e5cde2d5f05217d266b741939cbacd7a860d239e7d55cf777d24420c5dc3c9c9
Instruction Fuzzy Hash: 0F512935600205DFCB15DF68C495DADBBB1FF49354B088099E8469B362DB31ED86DBA0

Function 00D56B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00D56C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00D56C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00D56C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00D3AB79,00000000,00000000), ref: 00D56C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00D56CC7

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 39f6c7b685e70e3b1e163adafc79725649f530e7097708f13157a0e1c016e51e
Instruction ID: 50a829ae6d591e12aad55703470b598b46362d0f53dc92df7182468ae1fc3439
Opcode Fuzzy Hash: 39f6c7b685e70e3b1e163adafc79725649f530e7097708f13157a0e1c016e51e
Instruction Fuzzy Hash: 69419035604204AFDB248F28CC59BB97FA5EB09362F980268FC95E73A0C771ED45CA60

Function 00CF2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CF20C3
_free.LIBCMT ref: 00CF20E3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1f4ec459f957a8aeb78b9f2aef92f001c5759d364eb1a1020db4d182a9a25019
Instruction ID: 353b271fca53b6aac52a2060c038c0be931d882c9389655b2d658218a651106c
Opcode Fuzzy Hash: 1f4ec459f957a8aeb78b9f2aef92f001c5759d364eb1a1020db4d182a9a25019
Instruction Fuzzy Hash: 5141D532A00208DFCB24DF78C881A6DB7F5EF89314F158569E616EB395DB31AE01DB91

Function 00CD912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00CD9141
ScreenToClient.USER32(00000000,?), ref: 00CD915E
GetAsyncKeyState.USER32(00000001), ref: 00CD9183
GetAsyncKeyState.USER32(00000002), ref: 00CD919D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 6d2dde19e50ccb8d5c816b758aec64ad950f10e4a8d8d79c36368ede9015e452
Instruction ID: f44eb0d06ae4bbba664201b318670cc0cfe452f62eab51f2246b080c8a5e915c
Opcode Fuzzy Hash: 6d2dde19e50ccb8d5c816b758aec64ad950f10e4a8d8d79c36368ede9015e452
Instruction Fuzzy Hash: A241617590860AFBDF199F64D844BFEB774FF05320F204216E929A32E0CB346994DB61

Function 00D33874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00D338CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00D33922
TranslateMessage.USER32(?), ref: 00D3394B
DispatchMessageW.USER32(?), ref: 00D33955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D33966

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: d8f95164029230da23f88981ac27c7293ee4e65c7e8910123436ccf8d4e95fb2
Instruction ID: 561c2b348c720956238c091c952efb1e7fd29d99dea7a2365801c14468caa92f
Opcode Fuzzy Hash: d8f95164029230da23f88981ac27c7293ee4e65c7e8910123436ccf8d4e95fb2
Instruction Fuzzy Hash: 2331B774504342EFEB35CB759A49BB637A8EB05345F08056AE4A2C62A0E7F49685CF31

Function 00D3CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00D3CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00D3CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00D3C21E,00000000), ref: 00D3CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00D3C21E,00000000), ref: 00D3CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00D3C21E,00000000), ref: 00D3CFF2

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 011d8e5cebc8d5d48d2f9155a6c6130a2c6bbf2f41b803a3da64336e3dbe0b32
Instruction ID: c343871d17f8d7d5d83eb6cdd71cf47497dba96ca785a16998a72a89b17adb0c
Opcode Fuzzy Hash: 011d8e5cebc8d5d48d2f9155a6c6130a2c6bbf2f41b803a3da64336e3dbe0b32
Instruction Fuzzy Hash: F1315871625305AFDB20DFA5C884AAABBFAEF14351F14542EE506E2200EB30EE419B70

Function 00D21901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00D21915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00D219C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00D219C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00D219DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00D219E2

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 3dae1d73361abc423082e8c9f6c4fa6e1360ea0e158f9a8d3b1842282147f0d0
Instruction ID: 37aebf66d45cdb5020318ffa7dee56f253ddb464ccb4f48bba266b1a398befc0
Opcode Fuzzy Hash: 3dae1d73361abc423082e8c9f6c4fa6e1360ea0e158f9a8d3b1842282147f0d0
Instruction Fuzzy Hash: D3319075A00329EFCB00CFA8D959A9E7BB5EB24319F148225F961E72D1C7709944CFA0

Function 00D55706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00D55745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00D5579D
_wcslen.LIBCMT ref: 00D557AF
_wcslen.LIBCMT ref: 00D557BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00D55816

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 2502fb6bab647844a8a698f8cd02071b64110f6319038125afa11a039f097b5a
Instruction ID: 162480c20ac096a579e19dd106b418688f6a51d56bea5a7434a01209dc16d8fa
Opcode Fuzzy Hash: 2502fb6bab647844a8a698f8cd02071b64110f6319038125afa11a039f097b5a
Instruction Fuzzy Hash: 9321A531904618DADF219FA0EC84AED77BCFF05322F148216ED19EA184D770CA89CF60

Function 00D40930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00D40951
GetForegroundWindow.USER32 ref: 00D40968
GetDC.USER32(00000000), ref: 00D409A4
GetPixel.GDI32(00000000,?,00000003), ref: 00D409B0
ReleaseDC.USER32(00000000,00000003), ref: 00D409E8

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 29abf7a8cd9c755ddac3fb0bdbc0f7f05d348727fb145995a8d8c8e2e53e9ede
Instruction ID: 084f9a6fb677993ce1cf1ae2fbe2b08f82fa004b65842b816297e04b2ca09b58
Opcode Fuzzy Hash: 29abf7a8cd9c755ddac3fb0bdbc0f7f05d348727fb145995a8d8c8e2e53e9ede
Instruction Fuzzy Hash: 91215E35600314AFD704EF69C885AAEBBE5EF48741F04846CE84AE7762CA70AD04DB60

Function 00CFCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00CFCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CFCDE9

Part of subcall function 00CF3820: RtlAllocateHeap.NTDLL(00000000,?,00D91444,?,00CDFDF5,?,?,00CCA976,00000010,00D91440,00CC13FC,?,00CC13C6,?,00CC1129), ref: 00CF3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00CFCE0F
_free.LIBCMT ref: 00CFCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00CFCE31

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 85076694378a8d1421e9576e4816e153d4bdf5a4c51a3414a3d561161088a7c8
Instruction ID: 9a81fcc7a0b3943cf8ef9a8a7ba18834b282ea41241d035481a19f2c6d74f034
Opcode Fuzzy Hash: 85076694378a8d1421e9576e4816e153d4bdf5a4c51a3414a3d561161088a7c8
Instruction Fuzzy Hash: 4001D472B0171D7F236116B66DC8CBB696DDEC6BA13150129FE05C7201EA618E0191F2

Function 00CD9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00CD9693
SelectObject.GDI32(?,00000000), ref: 00CD96A2
BeginPath.GDI32(?), ref: 00CD96B9
SelectObject.GDI32(?,00000000), ref: 00CD96E2

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 31d9f6727cd8e8da37ef255686658465f460d4ec9502850be74a2bdf5579ace0
Instruction ID: 17b99fbd01917812717c08eaa3fa6cbe28e986dc6a611ae49edc692cead2213d
Opcode Fuzzy Hash: 31d9f6727cd8e8da37ef255686658465f460d4ec9502850be74a2bdf5579ace0
Instruction Fuzzy Hash: D6211938812306EBDB119F65EC14BA97BA8FB50356F104217F931E63A0D3709992CFA4

Function 00D25711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00D25726
_memcmp.LIBVCRUNTIME ref: 00D25744
_memcmp.LIBVCRUNTIME ref: 00D25757
_memcmp.LIBVCRUNTIME ref: 00D2576F
_memcmp.LIBVCRUNTIME ref: 00D25787

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: dd8c5b0993f85c3af1dd78f0e7698cabe281f4e92eb81303e3291d43d3a853d4
Instruction ID: e2fb08febdc42fde8ee077131073a4dacf3af0c10b879ccdf06fd03a6f36a438
Opcode Fuzzy Hash: dd8c5b0993f85c3af1dd78f0e7698cabe281f4e92eb81303e3291d43d3a853d4
Instruction Fuzzy Hash: 57019271681669BE96089611BE82EBB635C9B313A9B184030FD049F249F670ED2892B0

Function 00CF2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00CEF2DE,00CF3863,00D91444,?,00CDFDF5,?,?,00CCA976,00000010,00D91440,00CC13FC,?,00CC13C6), ref: 00CF2DFD
_free.LIBCMT ref: 00CF2E32
_free.LIBCMT ref: 00CF2E59
SetLastError.KERNEL32(00000000,00CC1129), ref: 00CF2E66
SetLastError.KERNEL32(00000000,00CC1129), ref: 00CF2E6F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 9fdc7df847968b642deb5d65733762c2dd6951201641f1ae8207d2fe31920cec
Instruction ID: 45884cc33442c5a97ea39d4f210814465cfe8df166dfb4f76e908958b6008507
Opcode Fuzzy Hash: 9fdc7df847968b642deb5d65733762c2dd6951201641f1ae8207d2fe31920cec
Instruction Fuzzy Hash: D501F43225570C6BD69227756C89D3B2A69ABC17A3B311029FB31E23A3EF748E015133

Function 00D2000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00D1FF41,80070057,?,?,?,00D2035E), ref: 00D2002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00D1FF41,80070057,?,?), ref: 00D20046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00D1FF41,80070057,?,?), ref: 00D20054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00D1FF41,80070057,?), ref: 00D20064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00D1FF41,80070057,?,?), ref: 00D20070

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 78fbb15837331af8cde62afc82dc12d761119f081e595b9f49ce1ae26d327bbd
Instruction ID: 67bc9a67bde6d33b4b5a5d5166758d35e5b0aa10f4340f840dc6dcbbf2bd5a88
Opcode Fuzzy Hash: 78fbb15837331af8cde62afc82dc12d761119f081e595b9f49ce1ae26d327bbd
Instruction Fuzzy Hash: 90018B72610324BFEB104F68ED44BAA7EADEB5879AF145124FD05D2321E771DD408BB0

Function 00D210F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00D21114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00D20B9B,?,?,?), ref: 00D21120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00D20B9B,?,?,?), ref: 00D2112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00D20B9B,?,?,?), ref: 00D21136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00D2114D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: a03fc80e738794ff1425a392ec68fa22fe6fb69232010e959d64f0b1a7ba33fb
Instruction ID: c1089ad020ebb6d69e7c8914e10f973ab95e27f012fc2532c8b0a3c18a90d423
Opcode Fuzzy Hash: a03fc80e738794ff1425a392ec68fa22fe6fb69232010e959d64f0b1a7ba33fb
Instruction Fuzzy Hash: 2D014B79200315BFDB124B64EC49E6A3F6EEF992A6B144414FE45D2360DA31DC10CA70

Function 00D20FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00D20FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00D20FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00D20FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00D20FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00D21002

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a0ddbab78f8d9400b42c2e0afe1c482fb00cc7d55cb483b46fa5256b09deea6f
Instruction ID: 2218453a2df56b7b45919618a9578bd64b97997631611bb7676c2f4f300233e7
Opcode Fuzzy Hash: a0ddbab78f8d9400b42c2e0afe1c482fb00cc7d55cb483b46fa5256b09deea6f
Instruction Fuzzy Hash: 10F04F39210315AFDB214FA5AD49F5A3BADEF99762F144414FD45C6391CA70DC408A70

Function 00D21014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00D2102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00D21036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D21045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00D2104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D21062

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 63b2244ac60033cd7f70dd448bd18df86e9ac14fac80a6d3df0067fda54a65f6
Instruction ID: 478d17d302580e68ec34d7fc4ab440fa37181c070e020fb16912eedc08a2f9df
Opcode Fuzzy Hash: 63b2244ac60033cd7f70dd448bd18df86e9ac14fac80a6d3df0067fda54a65f6
Instruction Fuzzy Hash: 61F04939210355AFDB215FA9ED4AF5A3BADEFA9762F144414FE46C6390CA70D8808A70

Function 00D3030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00D3017D,?,00D332FC,?,00000001,00D02592,?), ref: 00D30324
CloseHandle.KERNEL32(?,?,?,?,00D3017D,?,00D332FC,?,00000001,00D02592,?), ref: 00D30331
CloseHandle.KERNEL32(?,?,?,?,00D3017D,?,00D332FC,?,00000001,00D02592,?), ref: 00D3033E
CloseHandle.KERNEL32(?,?,?,?,00D3017D,?,00D332FC,?,00000001,00D02592,?), ref: 00D3034B
CloseHandle.KERNEL32(?,?,?,?,00D3017D,?,00D332FC,?,00000001,00D02592,?), ref: 00D30358
CloseHandle.KERNEL32(?,?,?,?,00D3017D,?,00D332FC,?,00000001,00D02592,?), ref: 00D30365

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d19438612461995e85d5d48585ed7f4ac5984ecdb86edd2b97ad7b81f3623167
Instruction ID: 378678c0f4f436e4c46f3adfa8a6d8f24131a04a6f00ee6e7b3b3aaae5ba73c4
Opcode Fuzzy Hash: d19438612461995e85d5d48585ed7f4ac5984ecdb86edd2b97ad7b81f3623167
Instruction Fuzzy Hash: 0701A272800B159FC7309F66D890412FBF9FF503153198A3FD19652931C371A954CF90

Function 00CFD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CFD752

Part of subcall function 00CF29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00CFD7D1,00000000,00000000,00000000,00000000,?,00CFD7F8,00000000,00000007,00000000,?,00CFDBF5,00000000), ref: 00CF29DE
Part of subcall function 00CF29C8: GetLastError.KERNEL32(00000000,?,00CFD7D1,00000000,00000000,00000000,00000000,?,00CFD7F8,00000000,00000007,00000000,?,00CFDBF5,00000000,00000000), ref: 00CF29F0

_free.LIBCMT ref: 00CFD764
_free.LIBCMT ref: 00CFD776
_free.LIBCMT ref: 00CFD788
_free.LIBCMT ref: 00CFD79A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 79548f7d065476b0cf367f5299348185334f01dc2618c4cef5700e8b31a6554d
Instruction ID: 5585db85c17437cb5cc89e372348744fabaedad951225ce36b64f0cf65968326
Opcode Fuzzy Hash: 79548f7d065476b0cf367f5299348185334f01dc2618c4cef5700e8b31a6554d
Instruction Fuzzy Hash: 11F044325A030DAB8695FB54F9C1C2677EEBB043107941806F255DB515C730FD805B72

Function 00D25C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00D25C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00D25C6F
MessageBeep.USER32(00000000), ref: 00D25C87
KillTimer.USER32(?,0000040A), ref: 00D25CA3
EndDialog.USER32(?,00000001), ref: 00D25CBD

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 621343637397862522a2e6063c5c9fb29fa609c61a0e5e8c520557f63cbcb579
Instruction ID: 599cd1b3bb1c970207c99e7d4a5b4d051a79263e85eeba1f47c3cb343e2af209
Opcode Fuzzy Hash: 621343637397862522a2e6063c5c9fb29fa609c61a0e5e8c520557f63cbcb579
Instruction Fuzzy Hash: 63018630510B14AFEB215B10FD4EFA677B8BB14B06F041559A583A15E1EBF0AA849AB0

Function 00CF22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CF22BE

Part of subcall function 00CF29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00CFD7D1,00000000,00000000,00000000,00000000,?,00CFD7F8,00000000,00000007,00000000,?,00CFDBF5,00000000), ref: 00CF29DE
Part of subcall function 00CF29C8: GetLastError.KERNEL32(00000000,?,00CFD7D1,00000000,00000000,00000000,00000000,?,00CFD7F8,00000000,00000007,00000000,?,00CFDBF5,00000000,00000000), ref: 00CF29F0

_free.LIBCMT ref: 00CF22D0
_free.LIBCMT ref: 00CF22E3
_free.LIBCMT ref: 00CF22F4
_free.LIBCMT ref: 00CF2305

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b98bd97cd445288e6682e57dfd63c86740decb05136f85a2ee012de59e4de6ff
Instruction ID: 3f778ca98a4be14b274bee6e2360a5d39acbaf2f2b5152cbe7309f3198d2e854
Opcode Fuzzy Hash: b98bd97cd445288e6682e57dfd63c86740decb05136f85a2ee012de59e4de6ff
Instruction Fuzzy Hash: 48F03A758A0326DB8652BF54BC028283F64BB18760700150BF624D73B1C7700A11ABBA

Function 00CD95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00CD95D4
StrokeAndFillPath.GDI32(?,?,00D171F7,00000000,?,?,?), ref: 00CD95F0
SelectObject.GDI32(?,00000000), ref: 00CD9603
DeleteObject.GDI32 ref: 00CD9616
StrokePath.GDI32(?), ref: 00CD9631

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 10336ccda01b0ca1f09052c9606f526c974d673eefbabef6f67b54bc189309a8
Instruction ID: 1af8aded5e8577d7de0ef09492b0064dd61c06625c5690b288064c38256c7117
Opcode Fuzzy Hash: 10336ccda01b0ca1f09052c9606f526c974d673eefbabef6f67b54bc189309a8
Instruction Fuzzy Hash: 76F0F638005705EFDB125F69ED18BA53B61EB00362F048216F935952F0D7318A91DF30

Function 00CF0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00CF10F9
__freea.LIBCMT ref: 00CF1117

Part of subcall function 00CF1537: _free.LIBCMT ref: 00CF154F

Strings

am/pm, xrefs: 00CF117A
a/p, xrefs: 00CF11DE

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 4db73199915f6dce843a8b83a25a4ef846babf7202d0f365e7ffcff5ff47a91e
Instruction ID: b09694c7199cd97d62e870c5d0058570285e3c76e0aa4ad87b5b251748714221
Opcode Fuzzy Hash: 4db73199915f6dce843a8b83a25a4ef846babf7202d0f365e7ffcff5ff47a91e
Instruction Fuzzy Hash: C9D1F23190024EDACBA88F69C845BBEB7B1EF05300F2C4119EF219B661D7359E84DB93

Function 00D47B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00CE0242: EnterCriticalSection.KERNEL32(00D9070C,00D91884,?,?,00CD198B,00D92518,?,?,?,00CC12F9,00000000), ref: 00CE024D
Part of subcall function 00CE0242: LeaveCriticalSection.KERNEL32(00D9070C,?,00CD198B,00D92518,?,?,?,00CC12F9,00000000), ref: 00CE028A

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

Part of subcall function 00CE00A3: __onexit.LIBCMT ref: 00CE00A9

__Init_thread_footer.LIBCMT ref: 00D47BFB

Part of subcall function 00CE01F8: EnterCriticalSection.KERNEL32(00D9070C,?,?,00CD8747,00D92514), ref: 00CE0202
Part of subcall function 00CE01F8: LeaveCriticalSection.KERNEL32(00D9070C,?,00CD8747,00D92514), ref: 00CE0235

Strings

Variable must be of type 'Object'., xrefs: 00D47C3A
5, xrefs: 00D47C78
G, xrefs: 00D47C7F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 280fef6f01fd7c7af74428ed4bf3d5bb0f8cdcbb12d44722eb0a40869f516bf5
Instruction ID: c30103a3cb6110835b937eb7e2b2af9339814e9d5ec99fe41127f678241e65ac
Opcode Fuzzy Hash: 280fef6f01fd7c7af74428ed4bf3d5bb0f8cdcbb12d44722eb0a40869f516bf5
Instruction Fuzzy Hash: 38916774A04209EFCB14EF94D891DBDB7B1FF48304F148059F846AB292DB71AE45DB61

Function 00D22716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D2B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00D221D0,?,?,00000034,00000800,?,00000034), ref: 00D2B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00D22760

Part of subcall function 00D2B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00D221FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00D2B3F8

Part of subcall function 00D2B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00D2B355
Part of subcall function 00D2B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00D22194,00000034,?,?,00001004,00000000,00000000), ref: 00D2B365
Part of subcall function 00D2B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00D22194,00000034,?,?,00001004,00000000,00000000), ref: 00D2B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00D227CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00D2281A

Strings

@, xrefs: 00D22832

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: d45d1c10c33c53bac201da4eaa9d790cb6240b7b789d75f5359fc579d6487b50
Instruction ID: 7c05c0ad4c7a95f943666ece9d45a3cec44d3d7bcdd1d79bf09632aed601a2ca
Opcode Fuzzy Hash: d45d1c10c33c53bac201da4eaa9d790cb6240b7b789d75f5359fc579d6487b50
Instruction Fuzzy Hash: 59413D72900228BFDB10DBA4DD81AEEBBB8EF15314F044095FA55B7191DB706E45CBB0

Function 00CF172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00CF1769
_free.LIBCMT ref: 00CF1834
_free.LIBCMT ref: 00CF183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00CF1760, 00CF1767, 00CF1796, 00CF17CE

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: c9a7b16aaa0f853ef9153efe1032266db56c17e8881f62b2e88491541e2bed8e
Instruction ID: 1b4aad8c40ef76fa77a56c952467a9fa127caf4b2a96185ec1419971b0b226df
Opcode Fuzzy Hash: c9a7b16aaa0f853ef9153efe1032266db56c17e8881f62b2e88491541e2bed8e
Instruction Fuzzy Hash: F7319175A0034CEFCB61EF9A9981DAEBBBCEB85350F184167EA14D7311D6704A40DBA1

Function 00D2C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00D2C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00D2C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00D91990,011C5490), ref: 00D2C395

Strings

0, xrefs: 00D2C2DF

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: ecf310f7d978f7f47f0e70ccbb39abd37bf8f40682d179e38de9accb32e67610
Instruction ID: a6793e2b7a7f435b55dfebc511db757532ec886899a2813745d1816c74e86514
Opcode Fuzzy Hash: ecf310f7d978f7f47f0e70ccbb39abd37bf8f40682d179e38de9accb32e67610
Instruction Fuzzy Hash: 2D418B312143519FD720DF25E884B5EBBA8EFA5328F049A1DE8A597291D770AD04CB72

Function 00D54416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00D5CC08,00000000,?,?,?,?), ref: 00D544AA
GetWindowLongW.USER32 ref: 00D544C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D544D7

Strings

SysTreeView32, xrefs: 00D5447C

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 3885123968c9c0ca1f413da2349a395b03f93a57f2eec80f64cb5d9f1523872e
Instruction ID: 798a24b8f7e6184bb45af7a6e5bf714a2301e6010106160c2ab969129c3b5c89
Opcode Fuzzy Hash: 3885123968c9c0ca1f413da2349a395b03f93a57f2eec80f64cb5d9f1523872e
Instruction Fuzzy Hash: B8319C31250205AFDF208E38DC45BEA77A9EB0833AF244715FD79A22E0D770EC959760

Function 00D4304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00D43077,?,?), ref: 00D43378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00D4307A
_wcslen.LIBCMT ref: 00D4309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00D43106

Strings

255.255.255.255, xrefs: 00D43095, 00D4309A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 2cd105f90414e0bdf4fd56668f99d2bbf40f72cdfb20a3ba9a03833a7b9e28a0
Instruction ID: 3b2550fbf5c6635f91dbc956dd3d44540b26b54d5aae17eda8526a68476e2806
Opcode Fuzzy Hash: 2cd105f90414e0bdf4fd56668f99d2bbf40f72cdfb20a3ba9a03833a7b9e28a0
Instruction Fuzzy Hash: 1131C1352043019FDB14CF6CC485EAA77E0EF14318F288199E9159B392DB72EE41CB70

Function 00D53EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00D53F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00D53F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00D53F78

Strings

SysMonthCal32, xrefs: 00D53F0B

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: f5073cd6668c7d59244ccecd4953fa3c9f7a0c65ba8812a22946fbe71521a2c4
Instruction ID: 10f1424c2d16d08b33246cef09e9149bcbb6214f09f7edfbfc7ea10a2353eabd
Opcode Fuzzy Hash: f5073cd6668c7d59244ccecd4953fa3c9f7a0c65ba8812a22946fbe71521a2c4
Instruction Fuzzy Hash: EA21BC32610219BFDF218F50CC46FEA3BB9EF48754F150214FE15AB1D0D6B1A955DBA0

Function 00D54653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00D54705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00D54713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00D5471A

Strings

msctls_updown32, xrefs: 00D54684

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 852cb1a60b3ebaa9e1b5de98bb513f8d40af1673b54a3d7ae0d167c71d692bc0
Instruction ID: 4a6c2ce4e433aba97889e225d69fd7c694a1ff386e4142180f289b8b9209e97b
Opcode Fuzzy Hash: 852cb1a60b3ebaa9e1b5de98bb513f8d40af1673b54a3d7ae0d167c71d692bc0
Instruction Fuzzy Hash: 1F214AB5600209AFDB11DF64DCC1EA637ADEB4A3A9B040459FE109B3A1CB30EC55DAB1

Function 00D295AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D2961D

Strings

#requireadmin, xrefs: 00D295D9
#notrayicon, xrefs: 00D295B7
#OnAutoItStartRegister, xrefs: 00D295F3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 5a069069b090dfbe31610ab86cf12b12782fc91506caaf5bcb78ee91796c0a1c
Instruction ID: 3a75731ba08fcc444bb09452a2d5e8408b8de051b854e2b5636c820ad239bec6
Opcode Fuzzy Hash: 5a069069b090dfbe31610ab86cf12b12782fc91506caaf5bcb78ee91796c0a1c
Instruction Fuzzy Hash: 8321383220416066D731AB25EC22FB7F3D8DF71319F18402AF9899B141EB51DD49D2B5

Function 00D537B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00D53840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00D53850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00D53876

Strings

Listbox, xrefs: 00D5380F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 59e0dd7dbce2c4c076ab8d8487baa3937395cca6d0ecb48be0eaa075839d2ac7
Instruction ID: c82a660f68ff219421df416ccb7c3ecb6125d0b27f37c95b3855c1a2278a794c
Opcode Fuzzy Hash: 59e0dd7dbce2c4c076ab8d8487baa3937395cca6d0ecb48be0eaa075839d2ac7
Instruction Fuzzy Hash: 2721B072610218BBEF118F64CC41FAB3B6AEF89791F108114FD109B190C671DC569BB0

Function 00D349F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D34A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00D34A5C
SetErrorMode.KERNEL32(00000000,?,?,00D5CC08), ref: 00D34AD0

Strings

%lu, xrefs: 00D34A6F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 5a068dee12483f940b08f81bc87ec816d6c03737b6d4737d35e7fa29f8ef8456
Instruction ID: 7621405a539b4182cca87208b176e0a6b8dad263ff6ea7abf106f9eb6159c220
Opcode Fuzzy Hash: 5a068dee12483f940b08f81bc87ec816d6c03737b6d4737d35e7fa29f8ef8456
Instruction Fuzzy Hash: D3312B75A00209AFDB10DF54C985EAA7BB8EF08308F1480A9F909DB252D775ED45DB71

Function 00D541EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00D5424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00D54264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00D54271

Strings

msctls_trackbar32, xrefs: 00D54226

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 16fb9b618165bfafc0924e5ae268aef026e6ee6e7286de3a05242e13af8e6048
Instruction ID: 12f92e6215fe2adc97fa39087906cac06610f95104f3d53ec2ecce4dfc0a1baa
Opcode Fuzzy Hash: 16fb9b618165bfafc0924e5ae268aef026e6ee6e7286de3a05242e13af8e6048
Instruction Fuzzy Hash: 6311E031240308BEEF205E29CC06FAB3BACEF85B69F114124FE55E20A0D671D8529B34

Function 00D22F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC6B57: _wcslen.LIBCMT ref: 00CC6B6A

Part of subcall function 00D22DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00D22DC5
Part of subcall function 00D22DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00D22DD6
Part of subcall function 00D22DA7: GetCurrentThreadId.KERNEL32 ref: 00D22DDD
Part of subcall function 00D22DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00D22DE4

GetFocus.USER32 ref: 00D22F78

Part of subcall function 00D22DEE: GetParent.USER32(00000000), ref: 00D22DF9

GetClassNameW.USER32(?,?,00000100), ref: 00D22FC3
EnumChildWindows.USER32(?,00D2303B), ref: 00D22FEB

Strings

%s%d, xrefs: 00D22FFF

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 52fe7f3f01eb3d1fae3c02055e29b4c0f0573d1d28826e5e016ce0e056f400cb
Instruction ID: a630505c813eb0fab4812f08ac50cf4567f2c5a59eff8c0e426b7ec3d23ba8b8
Opcode Fuzzy Hash: 52fe7f3f01eb3d1fae3c02055e29b4c0f0573d1d28826e5e016ce0e056f400cb
Instruction Fuzzy Hash: 2511CD712003156BCF14BF60AD95EEE37AAEFA4309F044079FD099B292DE349A499B70

Function 00D55882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00D558C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00D558EE
DrawMenuBar.USER32(?), ref: 00D558FD

Strings

0, xrefs: 00D5588F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 26b474ede620c5b5ec3a6208aced23cd37279c56c463e78dc2bf1a0d45e619f3
Instruction ID: 9fa47df1f24ad474ac916f8ba33bdbc65876292792c9b9d07b4b14239e030b13
Opcode Fuzzy Hash: 26b474ede620c5b5ec3a6208aced23cd37279c56c463e78dc2bf1a0d45e619f3
Instruction Fuzzy Hash: 0F013C31500218EFDB119F51E844BAABBB4BB45362F14809AED49D6265EB348A84EF71

Function 00D2007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0f7f476013411a903e743a7d6115bd2e01167fbfb03ad32734f3694f7ef06c
Instruction ID: 29e44153aea4c1a225e5256543477353e0090f1e9d501a3ffa041b3e1ce13d81
Opcode Fuzzy Hash: 9a0f7f476013411a903e743a7d6115bd2e01167fbfb03ad32734f3694f7ef06c
Instruction Fuzzy Hash: C6C17D75A0021AEFDB04CF94D894EAEBBB5FF58308F148598E405EB252C731ED41CBA0

Function 00CF3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00CF3F0B
__alldvrm.LIBCMT ref: 00CF410C
__alldvrm.LIBCMT ref: 00CF412E

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 72535001ab013f9f367f56818f44828876c82489908e728639181379a21e630f
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: DBA15871D0038AAFDB29CF58C8917BFBBF5EF61350F1441ADE6959B281C6348A81C762

Function 00D4342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00D43459
CoUninitialize.OLE32 ref: 00D43463
VariantInit.OLEAUT32(?), ref: 00D4346E
VariantClear.OLEAUT32(?), ref: 00D4371B

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 053a98ff7528396190c1f571313ee882ef219b25119146a54633d5452978a7dd
Instruction ID: b33aff05a2202f4bf14761e00ce1195d03b392d95f4d99bf0ab41c82b3ad90db
Opcode Fuzzy Hash: 053a98ff7528396190c1f571313ee882ef219b25119146a54633d5452978a7dd
Instruction Fuzzy Hash: A0A105756043019FCB10DF28C585A2AB7E5FF88714F09895DF98A9B362DB30EE41DBA1

Function 00D20436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00D5FC08,?), ref: 00D205F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00D5FC08,?), ref: 00D20608
CLSIDFromProgID.OLE32(?,?,00000000,00D5CC40,000000FF,?,00000000,00000800,00000000,?,00D5FC08,?), ref: 00D2062D
_memcmp.LIBVCRUNTIME ref: 00D2064E

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: f69b66a33d08f35aff33f4be547b6bbf86149f006adc9a8e8a5041106734acb2
Instruction ID: 6c2cc086ad33c51844f6c3d7c96db0fe97ca793624e4aaab0a745f1051b29b6c
Opcode Fuzzy Hash: f69b66a33d08f35aff33f4be547b6bbf86149f006adc9a8e8a5041106734acb2
Instruction Fuzzy Hash: 43814C71A00219EFCB04DF94C984EEEBBB9FF99315F244158E506EB251DB71AE06CB60

Function 00D01391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D014C0

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ab5f58b796563745a73203eb127a8a14a5b1a1576f37278d350c8b5cb7e6c424
Instruction ID: 97f63394dce7d5db7f3410aeb52f3d9b60fb164e81b515b1ca652c739ab860b8
Opcode Fuzzy Hash: ab5f58b796563745a73203eb127a8a14a5b1a1576f37278d350c8b5cb7e6c424
Instruction Fuzzy Hash: 86413B39A00614ABDB256FFD9C45BBE3AA4EF41370F184229F61DD71E2E774C8416272

Function 00D56278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00D562E2
ScreenToClient.USER32(?,?), ref: 00D56315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00D56382

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 2257f8b6524ada5363638db01141e20c58a779aa0690f490ed0928ee580844a1
Instruction ID: e80193170c5e66e9e506e369007aefaf52e79575e4a66dc73771965a756ee7bf
Opcode Fuzzy Hash: 2257f8b6524ada5363638db01141e20c58a779aa0690f490ed0928ee580844a1
Instruction Fuzzy Hash: 9E510A74A00209EFDF10DF68D881AAE7BB5EB45361F588169FC25DB2A0D730ED85CB60

Function 00D41AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00D41AFD
WSAGetLastError.WSOCK32 ref: 00D41B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00D41B8A
WSAGetLastError.WSOCK32 ref: 00D41B94

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: f387f42797044b4b8b715bd745a222ce418edeea4f9a93b5ffaec66a866342e0
Instruction ID: 71a15fc8381538ec3e2b31a79824c30d9e6255a7b0edece97e05a9ce3a0b0c62
Opcode Fuzzy Hash: f387f42797044b4b8b715bd745a222ce418edeea4f9a93b5ffaec66a866342e0
Instruction Fuzzy Hash: 95417038640300AFE720AF24C886F2977E5EB45718F54845CFA5A9F7D2D772DD819BA0

Function 00CFB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea050feaec64e9e1fbbd1e25cf463aec36d3a34bb38b16975c8d2917cf8ac666
Instruction ID: 6f10e504210d3b2ef51aabdbc971e1105bb869585ff47806e94d40fa31cd5d71
Opcode Fuzzy Hash: ea050feaec64e9e1fbbd1e25cf463aec36d3a34bb38b16975c8d2917cf8ac666
Instruction Fuzzy Hash: D1410675A00708AFD724AF38CC41BBABBA9EB88710F10452EF655DB682D771AD018B91

Function 00D356D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00D35783
GetLastError.KERNEL32(?,00000000), ref: 00D357A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00D357CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00D357FA

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 67e7a2343c5280ad3a3428d03f7e5a738e255bfef6769fed926a0a72dceff2d3
Instruction ID: 6b5417b5e5bfa485d4db930186596d93317d7ac8a4428eeed8edec85b4488317
Opcode Fuzzy Hash: 67e7a2343c5280ad3a3428d03f7e5a738e255bfef6769fed926a0a72dceff2d3
Instruction Fuzzy Hash: 4D411C35600610DFCB11DF55C545A5EBBE2EF89720F198488E84AAB366CB34FD41EFA1

Function 00CFD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00CE6D71,00000000,00000000,00CE82D9,?,00CE82D9,?,00000001,00CE6D71,8BE85006,00000001,00CE82D9,00CE82D9), ref: 00CFD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00CFD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00CFD9AB
__freea.LIBCMT ref: 00CFD9B4

Part of subcall function 00CF3820: RtlAllocateHeap.NTDLL(00000000,?,00D91444,?,00CDFDF5,?,?,00CCA976,00000010,00D91440,00CC13FC,?,00CC13C6,?,00CC1129), ref: 00CF3852

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 001e5584c27da8965b0ffb92f0820b70fa9c7f29fb8d0c944b57633966c005dc
Instruction ID: 18caea3b634ebf0f1a46d776e1a7a90a602365ce3a5a0496c04b24ccc3630cca
Opcode Fuzzy Hash: 001e5584c27da8965b0ffb92f0820b70fa9c7f29fb8d0c944b57633966c005dc
Instruction Fuzzy Hash: 6D31FC72A1030AABDF249FA5DC41EBE7BA6EB40310F050168FD15D7290EB75CE50CBA1

Function 00D552C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00D55352
GetWindowLongW.USER32(?,000000F0), ref: 00D55375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D55382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00D553A8

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: a1a8c16b18d21c4f93ef567c09820e55e528a22c6e84121c7704fea91282a4a1
Instruction ID: 667bab2aead9802bab07459b8b6824c34e0726a5c570466f5e269a38227e0d8c
Opcode Fuzzy Hash: a1a8c16b18d21c4f93ef567c09820e55e528a22c6e84121c7704fea91282a4a1
Instruction Fuzzy Hash: 0531F434A55B08EFFF329F54EC25BE83761AB04392F5C4002FE59962E4C7B099489B71

Function 00D2AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00D2ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00D2AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00D2AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00D2ACC6

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: cdc2411d7518492a458e88cfb833836d9f731f0f860e6c0b431dd831522687a6
Instruction ID: 4d24e7aaae3ac6b4e4593d684414f63d3bfa7f9b82a71ec4c9a9e6069e5d9c52
Opcode Fuzzy Hash: cdc2411d7518492a458e88cfb833836d9f731f0f860e6c0b431dd831522687a6
Instruction Fuzzy Hash: C3312C34904328AFFF34CB68EC047FE7765EFA5318F08421AE481921D1C3748985A772

Function 00D57674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00D5769A
GetWindowRect.USER32(?,?), ref: 00D57710
PtInRect.USER32(?,?,00D58B89), ref: 00D57720
MessageBeep.USER32(00000000), ref: 00D5778C

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: dbd99c677ef10c3b3e681a24d3566184e84153ed15297d95d6a168dc2c9e070f
Instruction ID: 7ef094086fa81e36a5ba9112e0b34d0fd1d60f932032c40fd8802899882cb89d
Opcode Fuzzy Hash: dbd99c677ef10c3b3e681a24d3566184e84153ed15297d95d6a168dc2c9e070f
Instruction Fuzzy Hash: 1A415A38605215AFCF01CF58E894AA977B5FB49316F2940A9EC25DB361D730A94ACFA0

Function 00D516DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00D516EB

Part of subcall function 00D23A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00D23A57
Part of subcall function 00D23A3D: GetCurrentThreadId.KERNEL32 ref: 00D23A5E
Part of subcall function 00D23A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00D225B3), ref: 00D23A65

GetCaretPos.USER32(?), ref: 00D516FF
ClientToScreen.USER32(00000000,?), ref: 00D5174C
GetForegroundWindow.USER32 ref: 00D51752

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 6ecb0e09c36a91dcc6b6928b4a1e750f5363e57023f294f4428bffc37e340b7c
Instruction ID: bd6fedd39755c6d9b1e91982d42aaec384c4eded1c2f54b03758de6605d0c82f
Opcode Fuzzy Hash: 6ecb0e09c36a91dcc6b6928b4a1e750f5363e57023f294f4428bffc37e340b7c
Instruction Fuzzy Hash: 20311075D00249AFCB04EFA9C881DAEBBF9EF48304B5480AEE815E7251D735DE45CBA0

Function 00D2DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00CC7620: _wcslen.LIBCMT ref: 00CC7625

_wcslen.LIBCMT ref: 00D2DFCB
_wcslen.LIBCMT ref: 00D2DFE2
_wcslen.LIBCMT ref: 00D2E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00D2E018

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: ba590be70c3d0c27c84963bdd8e88aba1a7d799e839f7ef6a1293fb6e3bb234e
Instruction ID: 4eab6b46a87fe8ff74d0c5b1d38a0a98aac2a2f66bba669ba3b87a25867f4d51
Opcode Fuzzy Hash: ba590be70c3d0c27c84963bdd8e88aba1a7d799e839f7ef6a1293fb6e3bb234e
Instruction Fuzzy Hash: 1221A371900224AFCB109FA8D981BAEB7F8EF55750F144065E905BB385D6709E418BB1

Function 00D2D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00D2D501
Process32FirstW.KERNEL32(00000000,?), ref: 00D2D50F
Process32NextW.KERNEL32(00000000,?), ref: 00D2D52F
CloseHandle.KERNEL32(00000000), ref: 00D2D5DC

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ee9842a323c85c45a0e5579e209cc73ff7a78650d33c08e25a584cffcd240980
Instruction ID: 4bad87e37f6df22c435fab04a28b4da37d8bfc8c9532907d1ae583a79fc3769f
Opcode Fuzzy Hash: ee9842a323c85c45a0e5579e209cc73ff7a78650d33c08e25a584cffcd240980
Instruction Fuzzy Hash: 50317E711083009FD300EF54D885EAFBBE8EF9A358F14092DF581862A1EB719944DBA2

Function 00D58FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00CD9BB2

GetCursorPos.USER32(?), ref: 00D59001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00D17711,?,?,?,?,?), ref: 00D59016
GetCursorPos.USER32(?), ref: 00D5905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00D17711,?,?,?), ref: 00D59094

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 66a49d821fe110bdfe49adc18a30727fa19f801b4e0836fc3134624d670ce7ec
Instruction ID: 3f160fb0f4d72b6531bfa20afa252d8d7696eb453f5022b87799313ffedfc28a
Opcode Fuzzy Hash: 66a49d821fe110bdfe49adc18a30727fa19f801b4e0836fc3134624d670ce7ec
Instruction Fuzzy Hash: 7A215C35600218FFDF258F98C868EEABBB9EB49352F144455FD05872A1D7319950EB70

Function 00D2D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00D5CB68), ref: 00D2D2FB
GetLastError.KERNEL32 ref: 00D2D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00D2D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00D5CB68), ref: 00D2D376

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: bcfa4b532475f6d6b7daae1cf1cb2951927863c82437280ff8efb11af5c0fdee
Instruction ID: 5f366a1ab4052d569671750e14fb89aa6da7111c73842bc8012ace4683c91b8e
Opcode Fuzzy Hash: bcfa4b532475f6d6b7daae1cf1cb2951927863c82437280ff8efb11af5c0fdee
Instruction Fuzzy Hash: 8421A1705083119F8700DF28D8859AE77E4EE66369F544A1DF899C32A1D730D949CBA7

Function 00D21571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D21014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00D2102A
Part of subcall function 00D21014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00D21036
Part of subcall function 00D21014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D21045
Part of subcall function 00D21014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00D2104C
Part of subcall function 00D21014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D21062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00D215BE
_memcmp.LIBVCRUNTIME ref: 00D215E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D21617
HeapFree.KERNEL32(00000000), ref: 00D2161E

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 1d837dc382b6a9abd475fc51acbd7445ce16a015a44d10411bba054a6c40c47a
Instruction ID: 959c7fe5f5837fd424cf5c89c1d4f5d362c711f4523d953bab1561003a83e5e9
Opcode Fuzzy Hash: 1d837dc382b6a9abd475fc51acbd7445ce16a015a44d10411bba054a6c40c47a
Instruction Fuzzy Hash: FC219031E00218EFDF10DFA4D945BEEB7F8EFA4359F188459E441A7241D730AA05CB60

Function 00D52782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00D5280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00D52824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00D52832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00D52840

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 9fdc2d50553d497d7cd7a1abe43e634b45006381410f3734390b34adf0ebeb32
Instruction ID: bd9032ad4ea7e6492f16563aaabeb8f8049835108d897cff770ebcadfd1a2e0e
Opcode Fuzzy Hash: 9fdc2d50553d497d7cd7a1abe43e634b45006381410f3734390b34adf0ebeb32
Instruction Fuzzy Hash: 19219231204611AFDB14DB64C845F7A7B95EF4A326F148158FC26CB6A2C771ED8AC7E0

Function 00D278F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D28D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00D2790A,?,000000FF,?,00D28754,00000000,?,0000001C,?,?), ref: 00D28D8C
Part of subcall function 00D28D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00D28DB2
Part of subcall function 00D28D7D: lstrcmpiW.KERNEL32(00000000,?,00D2790A,?,000000FF,?,00D28754,00000000,?,0000001C,?,?), ref: 00D28DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00D28754,00000000,?,0000001C,?,?,00000000), ref: 00D27923
lstrcpyW.KERNEL32(00000000,?), ref: 00D27949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00D28754,00000000,?,0000001C,?,?,00000000), ref: 00D27984

Strings

cdecl, xrefs: 00D2797B

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 1a6acb2cc331b639d0aeb7a390944bb669fec8fe9cdfc3256bc30e89dcdd350b
Instruction ID: b8101be214f5ca6fca825a8c880f1ee2ee59a582dd3660728b9e5a2538ed1b53
Opcode Fuzzy Hash: 1a6acb2cc331b639d0aeb7a390944bb669fec8fe9cdfc3256bc30e89dcdd350b
Instruction Fuzzy Hash: A911293A200311AFCB255F34E844E7A77A5FF65354B00402AF946C73A4EB31D841DB71

Function 00D57CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00D57D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00D57D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00D57D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00D3B7AD,00000000), ref: 00D57D6B

Part of subcall function 00CD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00CD9BB2

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 26710c12df0e87bc7bfb5a4e5eba3421038802c62ee40daf504958af59c07e1c
Instruction ID: ace90ede7eded125a67f72f857209363be149c84923a0aaffce7ce44a2181819
Opcode Fuzzy Hash: 26710c12df0e87bc7bfb5a4e5eba3421038802c62ee40daf504958af59c07e1c
Instruction Fuzzy Hash: 6511AC35214715AFCF108F28EC04AAA3BA5AF45362B294326FC39D72F0EB319955CB60

Function 00D55660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00D556BB
_wcslen.LIBCMT ref: 00D556CD
_wcslen.LIBCMT ref: 00D556D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00D55816

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 92dfc92c464594ff63f3fea08e1aa49f89a04561b6b29f338652ec089c7645b5
Instruction ID: d744b4129189a1f7f4a8b0459a3ed21923bf47c517ac9a83a4056c9e5be2624e
Opcode Fuzzy Hash: 92dfc92c464594ff63f3fea08e1aa49f89a04561b6b29f338652ec089c7645b5
Instruction Fuzzy Hash: 27110335600608AADF219FA1EC81AEE37BCEF01362B144026FD05D6085EB70CA88CF70

Function 00CF1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8392602b3ea4a425368f70e095c309156ab333a3e55ee4dd5ec72868c37488
Instruction ID: 696abc3943060666b9bd4f8871df4ade810fe762984b4a510ce79397852559df
Opcode Fuzzy Hash: bf8392602b3ea4a425368f70e095c309156ab333a3e55ee4dd5ec72868c37488
Instruction Fuzzy Hash: 8F014FB2205B1EBEF69216796CC1F77662DDF413B8B391325FB31A12D2DB608D005172

Function 00D21A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00D21A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D21A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D21A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D21A8A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a7e6674c1aa565e5f5f78b97eeb9ca17053b8753277306f77bef616f6398b4b5
Instruction ID: 14b197056d56892ed506cbfb7ff30189b81fd4c22d2fe9c8616ba0f9b57c1f25
Opcode Fuzzy Hash: a7e6674c1aa565e5f5f78b97eeb9ca17053b8753277306f77bef616f6398b4b5
Instruction Fuzzy Hash: 29113C3AD01229FFEB10DBA4CD85FADBB78FB18754F204091EA00B7290D6716E51DBA4

Function 00D2E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00D2E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00D2E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00D2E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00D2E24D

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 836bbb460af0b5283da9a919db01a59bd68d01685b9827879a47323c78071491
Instruction ID: 3017c74d04d4ac6f64955b15fd5f7c11a702ff0e280513e2c66c4641f30f4846
Opcode Fuzzy Hash: 836bbb460af0b5283da9a919db01a59bd68d01685b9827879a47323c78071491
Instruction Fuzzy Hash: 1611C476904369FFD7019BA8AC09A9E7FACEF45325F14425AF925E3391D6B0CD0487B0

Function 00CED1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00CECFF9,00000000,00000004,00000000), ref: 00CED218
GetLastError.KERNEL32 ref: 00CED224
__dosmaperr.LIBCMT ref: 00CED22B
ResumeThread.KERNEL32(00000000), ref: 00CED249

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: f552547e2558c019a34d0bc343d65fcd411377bb80f609d49e45c93bcfa4ba05
Instruction ID: 0b7d5ac7697893d2f470270df0dcfe3c65515fbd28fe8fcf3c94afd726147069
Opcode Fuzzy Hash: f552547e2558c019a34d0bc343d65fcd411377bb80f609d49e45c93bcfa4ba05
Instruction Fuzzy Hash: 5B012236805388BFDB106BA7DC09BAE3A69EF81331F100219FA26921D0CB708D01D6A0

Function 00D59EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00CD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00CD9BB2

GetClientRect.USER32(?,?), ref: 00D59F31
GetCursorPos.USER32(?), ref: 00D59F3B
ScreenToClient.USER32(?,?), ref: 00D59F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00D59F7A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 859071985227067ca3fde10c38e1da57c3447b4b4904eaa28c19e1fb6924e750
Instruction ID: 4d5830fc315d8370fd552d245caa2ae2fb758f675b398d801fc611c19f775303
Opcode Fuzzy Hash: 859071985227067ca3fde10c38e1da57c3447b4b4904eaa28c19e1fb6924e750
Instruction Fuzzy Hash: 0D11223690021AEBDF109FA8D8999EEB7B8EF05312F040451FD11E3250D730BA89CBB1

Function 00CC600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00CC604C
GetStockObject.GDI32(00000011), ref: 00CC6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00CC606A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: b97f62bb39cdbda6b8cebbb748d474f5e2e440733ba0af6c97958c6fd5b8c0af
Instruction ID: 839f39975cda51a78adae4a174d105012b73ce227ff487915f30c244517cf018
Opcode Fuzzy Hash: b97f62bb39cdbda6b8cebbb748d474f5e2e440733ba0af6c97958c6fd5b8c0af
Instruction Fuzzy Hash: FF115E72501709BFEF124F94DD44FEABF69EF08395F050119FE14A2110D7329D609BA4

Function 00CE3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00CE3B56

Part of subcall function 00CE3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00CE3AD2
Part of subcall function 00CE3AA3: ___AdjustPointer.LIBCMT ref: 00CE3AED

_UnwindNestedFrames.LIBCMT ref: 00CE3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00CE3B7C
CallCatchBlock.LIBVCRUNTIME ref: 00CE3BA4

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: e8bcef6bcbf7bf933a239084494b69b0d25979c66b55407d3ee0a8a8c0bec63d
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: D7010C321001C9BBDF126E96CC46EEB7F6EEF98754F044054FE5896121C732E961EBA0

Function 00CF3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00CC13C6,00000000,00000000,?,00CF301A,00CC13C6,00000000,00000000,00000000,?,00CF328B,00000006,FlsSetValue), ref: 00CF30A5
GetLastError.KERNEL32(?,00CF301A,00CC13C6,00000000,00000000,00000000,?,00CF328B,00000006,FlsSetValue,00D62290,FlsSetValue,00000000,00000364,?,00CF2E46), ref: 00CF30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00CF301A,00CC13C6,00000000,00000000,00000000,?,00CF328B,00000006,FlsSetValue,00D62290,FlsSetValue,00000000), ref: 00CF30BF

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 648a78fe94a1dba6cbb5871393862a4278568d977232d5efbf64a81532cd6b2e
Instruction ID: 2852446bc877dee4416e234e7a7dd70c9956dc56461717bbba06781f82ceebd8
Opcode Fuzzy Hash: 648a78fe94a1dba6cbb5871393862a4278568d977232d5efbf64a81532cd6b2e
Instruction Fuzzy Hash: 8301B13231136ABBCB614A69AC44A667B98AF45BA1B110621EE15E3280CF21DA41C6E1

Function 00D27464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00D2747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00D27497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00D274AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00D274CA

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: a0d1bc49f707d2d81847fba9e6ca96548094234e154224196d3109e446e6cd5b
Instruction ID: 2065a06935cdff0ecc1628c9e1db2520e275ac1dd57733920b10e316412e196e
Opcode Fuzzy Hash: a0d1bc49f707d2d81847fba9e6ca96548094234e154224196d3109e446e6cd5b
Instruction Fuzzy Hash: 7A11C4B12053249FE7309F14EC08F927FFCEB00B08F108569AA66D6151D770E905DB71

Function 00D2B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00D2ACD3,?,00008000), ref: 00D2B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00D2ACD3,?,00008000), ref: 00D2B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00D2ACD3,?,00008000), ref: 00D2B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00D2ACD3,?,00008000), ref: 00D2B126

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 0fb00bff933e2e6a8c3251dc26a1d3299d45ab3c5f0071abef0877487a687e97
Instruction ID: 23610930d5576eb476d3edd62b1f8fa6b2df5df205d8dac5a0e6ad8404b59ba3
Opcode Fuzzy Hash: 0fb00bff933e2e6a8c3251dc26a1d3299d45ab3c5f0071abef0877487a687e97
Instruction Fuzzy Hash: 8C113C31D01B39EBCF01AFA4E968AEEBB78FF2A725F104086D941B2241CB7095508B61

Function 00D57E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00D57E33
ScreenToClient.USER32(?,?), ref: 00D57E4B
ScreenToClient.USER32(?,?), ref: 00D57E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D57E8A

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 050e62457a9a0db6ef1cba86b60c2dfe6a4e87235d3e6aedcc4110684b3b0092
Instruction ID: e31e667a6703a64b1eb9ca8e728fc58a110d83381f96682687e945441aaac913
Opcode Fuzzy Hash: 050e62457a9a0db6ef1cba86b60c2dfe6a4e87235d3e6aedcc4110684b3b0092
Instruction Fuzzy Hash: 991143B9D0030AAFDB41CF98D8849EEBBF5FB08311F505056E915E2210D735AA55CF60

Function 00D22DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00D22DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00D22DD6
GetCurrentThreadId.KERNEL32 ref: 00D22DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00D22DE4

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: b4462bde7d7b7686c03478e6379fd2ff7519280de5356cd204e16db7dc8301e7
Instruction ID: 39e144200f42fbb3bb070a494d11cf98fc64018591efa0ce2a1ca906b2056be3
Opcode Fuzzy Hash: b4462bde7d7b7686c03478e6379fd2ff7519280de5356cd204e16db7dc8301e7
Instruction Fuzzy Hash: 75E06D722113347BD7201B72AC0DEFB3E6CEB52BA6F041015B905D11909AA5C940C6F0

Function 00D58863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00CD9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00CD9693
Part of subcall function 00CD9639: SelectObject.GDI32(?,00000000), ref: 00CD96A2
Part of subcall function 00CD9639: BeginPath.GDI32(?), ref: 00CD96B9
Part of subcall function 00CD9639: SelectObject.GDI32(?,00000000), ref: 00CD96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00D58887
LineTo.GDI32(?,?,?), ref: 00D58894
EndPath.GDI32(?), ref: 00D588A4
StrokePath.GDI32(?), ref: 00D588B2

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 7d1b6368635b1c27d96234b8697a84d68989465249b69b246cd17914bc63c769
Instruction ID: 00a3e3c68edebeb63d3f970a522058b67264d0ceb434540201eb65bb9f608dc9
Opcode Fuzzy Hash: 7d1b6368635b1c27d96234b8697a84d68989465249b69b246cd17914bc63c769
Instruction Fuzzy Hash: 41F03A3A041359BADB126F98AC09FCA3F59AF16352F048001FE21A52E1C7755511DFF5

Function 00CD98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00CD98CC
SetTextColor.GDI32(?,?), ref: 00CD98D6
SetBkMode.GDI32(?,00000001), ref: 00CD98E9
GetStockObject.GDI32(00000005), ref: 00CD98F1

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: fc6e3643e7f923d87b634669f39cd9abfafccae0599aa57a755f772a2f2a26a8
Instruction ID: e893214c004cf887e1df699762fac127451e1f37cf3736c74fc98c18f4fa891f
Opcode Fuzzy Hash: fc6e3643e7f923d87b634669f39cd9abfafccae0599aa57a755f772a2f2a26a8
Instruction Fuzzy Hash: 78E06531254740AEDB215B74FC09BD83F21EB11376F048219FAF9941E1C77146409B30

Function 00D2162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00D21634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00D211D9), ref: 00D2163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00D211D9), ref: 00D21648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00D211D9), ref: 00D2164F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: e924e3cae3f133c59aa5241b9af088f11b0f4396717c6c3d89cbfd5100c71453
Instruction ID: 84fd7956e857ecd99cc4f51eb2c94f11120a12c95f200a5c2cf21726ef79fc01
Opcode Fuzzy Hash: e924e3cae3f133c59aa5241b9af088f11b0f4396717c6c3d89cbfd5100c71453
Instruction Fuzzy Hash: 8CE04F75612321AFD7301BA4AD0DB4A3B68AF64B97F188808FA45C9080D6244440C774

Function 00D1D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00D1D858
GetDC.USER32(00000000), ref: 00D1D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00D1D882
ReleaseDC.USER32(?), ref: 00D1D8A3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: e3d17cb93b107a1be48002ed3b3e8a1303d8022cc44690f5433af91ebbd58e4a
Instruction ID: 3eda56d0b28f4ea7819a3996976dbf7246f827199809569025a09c4354a45a5a
Opcode Fuzzy Hash: e3d17cb93b107a1be48002ed3b3e8a1303d8022cc44690f5433af91ebbd58e4a
Instruction Fuzzy Hash: 97E0E5B0810304EFCB419FA4D808A6DBBB2EB08312B109009E84AE7360CB389A41EF60

Function 00D1D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00D1D86C
GetDC.USER32(00000000), ref: 00D1D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00D1D882
ReleaseDC.USER32(?), ref: 00D1D8A3

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: febc21f114ff6bd266481bd812840e9a2fd2aedc4a088ffd387920107316aa57
Instruction ID: 933dbc8aaf1ab1cc77f132afff2dd36447c0238a23a958adda7d3ab16f99e551
Opcode Fuzzy Hash: febc21f114ff6bd266481bd812840e9a2fd2aedc4a088ffd387920107316aa57
Instruction Fuzzy Hash: 96E01A70C10300DFCF409FA4D80866DBBB1FB08312B109009F90AE7360C7385A01EF60

Function 00D34D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC7620: _wcslen.LIBCMT ref: 00CC7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00D34ED4

Strings

LPT, xrefs: 00D34DFB
*, xrefs: 00D34E10

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 896f4a33e3c21a6707d278060e7f99bfa2445a2b84c04e6ae6de906e9d16be8e
Instruction ID: b24833fc8ce7110fe559b5fca7f6979505ab69449b1194f5ad62474189ebdbc3
Opcode Fuzzy Hash: 896f4a33e3c21a6707d278060e7f99bfa2445a2b84c04e6ae6de906e9d16be8e
Instruction Fuzzy Hash: FD914D75A002049FCB14DF58C484EAABBF1BF45304F1D8099E84A9F362D735EE85CBA1

Function 00CEE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00CEE30D

Strings

pow, xrefs: 00CEE2E5, 00CEE302

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: a989acb8f5335d039a722a10f514ef830a19db784a9ebe548407116a3a727f32
Instruction ID: 0ac54f13e62e4ed4f9f2ec31cab12a33c9274801724cf7ec9cdd7d72298c2d07
Opcode Fuzzy Hash: a989acb8f5335d039a722a10f514ef830a19db784a9ebe548407116a3a727f32
Instruction Fuzzy Hash: F851AC61A0C74A96CB117B16CD013BA3BA4EF407C0F304A69E1F5833F9EB348D91AA53

Function 00CDE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00CDE1B1

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: fc7f9f0c33e20bfffaa82eab6a5f060f4b661aa8010f72afdbb1e3da6868f4bc
Instruction ID: 6660de017c24e7c1d5c4691808898b3dea420a5f7cf8763764bb791692e7bc41
Opcode Fuzzy Hash: fc7f9f0c33e20bfffaa82eab6a5f060f4b661aa8010f72afdbb1e3da6868f4bc
Instruction Fuzzy Hash: 7B511775500346EFEB15EF68D481AFA7BA4EF55310F28405AED919F2D0DB309E82D7A0

Function 00CDF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00CDF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00CDF2BB

Strings

@, xrefs: 00CDF2AF

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 2d7223f390622e82b6bfb1ff01b8bb28f445f87159ee3a4745c8c2cc24dd9647
Instruction ID: b79794a2ed9d4efb50b66fab3f8f64980e2fd03b65cbe29ab04b82857fc793e6
Opcode Fuzzy Hash: 2d7223f390622e82b6bfb1ff01b8bb28f445f87159ee3a4745c8c2cc24dd9647
Instruction Fuzzy Hash: 5B5134724187449BD320AF54DC86BABBBF8FB84300F81895DF1D9811A5EB708569CB66

Function 00D45745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00D457E0
_wcslen.LIBCMT ref: 00D457EC

Strings

CALLARGARRAY, xrefs: 00D457E6, 00D457EB

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 2cdaf7669dc2cb715052cdc3d9864d1bd174045aaf72fe9f4206fea85b7f87ef
Instruction ID: 576e4862a1e2387fda4beb139afec030e769052ce161bffa8e6e8b19a5d6f466
Opcode Fuzzy Hash: 2cdaf7669dc2cb715052cdc3d9864d1bd174045aaf72fe9f4206fea85b7f87ef
Instruction Fuzzy Hash: 8E419F31E002099FCF14EFA8D8859AEBBB5EF59324F144169E505A7396EB309D81DBB0

Function 00D3D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D3D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00D3D13A

Strings

|, xrefs: 00D3D10B

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: aedb38df0d028c80da50399984e7f7d65af2cf9ada757166b3fe007f70a35e0c
Instruction ID: ee2efa931d8e2916e6b1b4172e53e06bf3e5e3a90dac38539f82761abb77a7dd
Opcode Fuzzy Hash: aedb38df0d028c80da50399984e7f7d65af2cf9ada757166b3fe007f70a35e0c
Instruction Fuzzy Hash: 9B31F871D00219ABCF15EFA5DD85EEEBFBAFF04340F100019E815A6166E731AA56DB60

Function 00D5356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00D53621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00D5365C

Strings

static, xrefs: 00D535BC

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 44473c772f08ededd56ba700671b96882e24c229252b8b7899fa6192d5768783
Instruction ID: 51cb524a886ef1b0392cdffd917fff92cd2b4754034f9afb0c48e0db508067cd
Opcode Fuzzy Hash: 44473c772f08ededd56ba700671b96882e24c229252b8b7899fa6192d5768783
Instruction Fuzzy Hash: 0C317871110604AEDB109F68D880EBB73A9EF887A1F10961DFDA5D7290DA30A9969B70

Function 00D54537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00D5461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00D54634

Strings

', xrefs: 00D5458E

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: f9aa8236f7db66a2ce786674255e0c27a24ef25334f567075ed8fed3a1b13113
Instruction ID: 2fe0634f9fb16fc4f3ead22ede699bcf095a89015f8b9594b636c741c2c9e171
Opcode Fuzzy Hash: f9aa8236f7db66a2ce786674255e0c27a24ef25334f567075ed8fed3a1b13113
Instruction Fuzzy Hash: F1310674A0130AAFDF14CF69C990BDA7BB5FB09305F14406AED04AB391E770A985CFA1

Function 00D531EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00D5327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D53287

Strings

Combobox, xrefs: 00D53249

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: f218fec20bffa42597039d388c57cd036b895e090d82f0a80eb62a9a7762ac1b
Instruction ID: af99ad48273633980cdf1c9cd5ed13b0c395d7913fbdaf8dcc2d2072b6258dbf
Opcode Fuzzy Hash: f218fec20bffa42597039d388c57cd036b895e090d82f0a80eb62a9a7762ac1b
Instruction Fuzzy Hash: 4311EF713006087FEF219E94DC80EBB3B6AEB983A5F144128FD18EB290D631DD6597B4

Function 00D53710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00CC600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00CC604C
Part of subcall function 00CC600E: GetStockObject.GDI32(00000011), ref: 00CC6060
Part of subcall function 00CC600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00CC606A

GetWindowRect.USER32(00000000,?), ref: 00D5377A
GetSysColor.USER32(00000012), ref: 00D53794

Strings

static, xrefs: 00D53757

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 4a5460514e3e03fca154904f4e2e0e2f1b576eb1a64e647d30fc4c8380f04277
Instruction ID: b778abc3fa083ed91c66fc01c901dc43fb2ea5ad616e3b855aa932cbc4c949ac
Opcode Fuzzy Hash: 4a5460514e3e03fca154904f4e2e0e2f1b576eb1a64e647d30fc4c8380f04277
Instruction Fuzzy Hash: 9B1167B2A1020AAFDF00DFA8CC46EEA7BB8FB08345F004914FD95E2250E734E855DB60

Function 00D3CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00D3CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00D3CDA6

Strings

<local>, xrefs: 00D3CD66

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: b7e6bc78a474c7c4f515b3e4e2a0cdb79538b1f88104dd22ff5d7db17c07f5f8
Instruction ID: 9d5118e1125fd51bde308158ad432897b4ac8f1948e5faf884eb7e638e0f978f
Opcode Fuzzy Hash: b7e6bc78a474c7c4f515b3e4e2a0cdb79538b1f88104dd22ff5d7db17c07f5f8
Instruction Fuzzy Hash: E111C275225731BED7384B66AC49EF7BEACEF127A4F00522AB549A3180D7709841D7F0

Function 00D53429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00D534AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00D534BA

Strings

edit, xrefs: 00D5348F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 3278ac9c15d26a82208d688955bd14314ad249dd321a701be0ed98d513d6088c
Instruction ID: 6c43e89f9de77e4a30ed614e50988ce7e334afd0ab815b27ddcd4d7bc465a58d
Opcode Fuzzy Hash: 3278ac9c15d26a82208d688955bd14314ad249dd321a701be0ed98d513d6088c
Instruction Fuzzy Hash: 9C116A71100208AFEF128E64DC44AAB376AEB053B6F544724FD61D32E0C771DD9AAB70

Function 00D26C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00D26CB6
_wcslen.LIBCMT ref: 00D26CC2

Strings

STOP, xrefs: 00D26CBC, 00D26CC1

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 5181660dbc0433c5c236081d655522b85e18c5764479594952ebb3ff75a13afd
Instruction ID: 00a4003fd8f3aa5f13da014c3b9ff924f71a19432b6377a4a197d65ba3629a8e
Opcode Fuzzy Hash: 5181660dbc0433c5c236081d655522b85e18c5764479594952ebb3ff75a13afd
Instruction Fuzzy Hash: 39010432A0063A8BCB20AFBDEC809BF37A4EB717187040528E86293190EA31D940D660

Function 00D21CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

Part of subcall function 00D23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00D23CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00D21D4C

Strings

ComboBox, xrefs: 00D21CEB
ListBox, xrefs: 00D21D16

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: e7f3939b372a730702ab9d8d55f960575962910c732968c0c133bdb1b28d3aa5
Instruction ID: 2e173620109fbcc187abd9af0ce5a726dca86b59808dc952e25880f67130fbee
Opcode Fuzzy Hash: e7f3939b372a730702ab9d8d55f960575962910c732968c0c133bdb1b28d3aa5
Instruction Fuzzy Hash: 4A01D875601224ABCB04EFA4EC55EFE7768EB76354F044619F872573D1EA3059089770

Function 00D21BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

Part of subcall function 00D23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00D23CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00D21C46

Strings

ComboBox, xrefs: 00D21BE5
ListBox, xrefs: 00D21C10

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 9aba860fe9ab519a96eb558f8f912dd2e566894978ae7014f795a930e29b1b68
Instruction ID: b292a9921ac3b102d868a5745c4147bbb0c8b4d8159719b0bce35faf78461c47
Opcode Fuzzy Hash: 9aba860fe9ab519a96eb558f8f912dd2e566894978ae7014f795a930e29b1b68
Instruction Fuzzy Hash: F301A7797812186ACB04FB90E955EFFB7A8DB32344F140019E816772C1EA349F1CA7B1

Function 00D21C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

Part of subcall function 00D23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00D23CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00D21CC8

Strings

ComboBox, xrefs: 00D21C69
ListBox, xrefs: 00D21C94

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 57ccfb85889a61ce39808c469f461e44bce9df0f30baf63cea3140b3b86db1b2
Instruction ID: a0650941888529f1f77192dbbd7310c92b2b37f96977ddc78bf9da93a5731523
Opcode Fuzzy Hash: 57ccfb85889a61ce39808c469f461e44bce9df0f30baf63cea3140b3b86db1b2
Instruction Fuzzy Hash: 7A01DB797402246BCB04FB91DA15FFEB7ACDB31344F140019B80173281EA319F18E671

Function 00D21D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC9CB3: _wcslen.LIBCMT ref: 00CC9CBD

Part of subcall function 00D23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00D23CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00D21DD3

Strings

ComboBox, xrefs: 00D21D75
ListBox, xrefs: 00D21DA0

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: bfbdad3948dc63bfb75e3e0324ad520046d684542a739af8266fc5df98335773
Instruction ID: 0f8e3600691c0eb41fc43cc5acb4bd83ddc9d681bb2bf5dbc28404a1269fc8c0
Opcode Fuzzy Hash: bfbdad3948dc63bfb75e3e0324ad520046d684542a739af8266fc5df98335773
Instruction Fuzzy Hash: 0DF0A475B41228AADB14FBA4EC56FFE7768EB22354F040919F862632C1DA719A0C9270

Function 00D4747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D47493
_wcslen.LIBCMT ref: 00D474B9

Strings

3, 3, 16, 1, xrefs: 00D47483

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: b96b5b183ccd8268a9cd3c9986f4399c9d1e448aaf5ec5ba1adbc851283fbc4b
Instruction ID: 297275771a3faf96d482e881e2d04318efd4f2a11c146a9a43a5edeecabd8d06
Opcode Fuzzy Hash: b96b5b183ccd8268a9cd3c9986f4399c9d1e448aaf5ec5ba1adbc851283fbc4b
Instruction Fuzzy Hash: 9FE06102304360159335227BDCC197F578DCFC9750714182BF989D2267EB94CD91A3F1

Function 00D20B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00D20B23

Strings

Error allocating memory., xrefs: 00D20B1C
AutoIt, xrefs: 00D20B17

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 1b6f2a12f2cbb0a0a12e8da7303798d2a017cf4f299f59be51280ae747f3d304
Instruction ID: c91d81da9a3030f8535ca62bfbff792657c93c1ceb626dcd4bbd399e94879566
Opcode Fuzzy Hash: 1b6f2a12f2cbb0a0a12e8da7303798d2a017cf4f299f59be51280ae747f3d304
Instruction Fuzzy Hash: 8CE0D8312443182ED21436957C03F897F84DF09F52F10042BFF48956C38AD124545AB9

Function 00CE0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00CDF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00CE0D71,?,?,?,00CC100A), ref: 00CDF7CE

IsDebuggerPresent.KERNEL32(?,?,?,00CC100A), ref: 00CE0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00CC100A), ref: 00CE0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00CE0D7F

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 9e624df3c104cc89b3e7999e776d0aac88db15c417dc4e0da030c152da6d52e1
Instruction ID: 69e5ad44c4a70ceaa6db4cbd47dd62c3b0277fe8aac6f11a862afb2c5ad51226
Opcode Fuzzy Hash: 9e624df3c104cc89b3e7999e776d0aac88db15c417dc4e0da030c152da6d52e1
Instruction Fuzzy Hash: 30E06D742007518FD7209FB9D8087467BE0BB00745F11492DE882C6751DBF4E5888BF1

Function 00D33017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00D3302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00D33044

Strings

aut, xrefs: 00D33038

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: e77b82fd85aaf7e47e34da3bca4c74742f5d671d46b4105ff33824d5548395e4
Instruction ID: 07ad890ab4a991a2a28f8a0fbe6f2ad3598282f38051e317e8528c4865809e14
Opcode Fuzzy Hash: e77b82fd85aaf7e47e34da3bca4c74742f5d671d46b4105ff33824d5548395e4
Instruction Fuzzy Hash: C4D05E725003286BDA20A7A5AC4EFCB3A6CDB05761F0002A1BA55E2191EAB0D984CBE4

Function 00D1D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00D1D220

Strings

%.3d, xrefs: 00D1D22B
X64, xrefs: 00D1D2A8

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 5c9c4b2cb879bd34f6aac54a08212971b667c30a317c2fce73bc11afd93e0d78
Instruction ID: a17747c7564fa69c90d91c281f9d7f25845a4dba4e10936e7df15e6e8b8a262d
Opcode Fuzzy Hash: 5c9c4b2cb879bd34f6aac54a08212971b667c30a317c2fce73bc11afd93e0d78
Instruction Fuzzy Hash: 76D01261C08218FACB5096D0EC859FAB37DFB19301F608453F967D1140DB34D5886775

Function 00D52356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D5236C
PostMessageW.USER32(00000000), ref: 00D52373

Part of subcall function 00D2E97B: Sleep.KERNELBASE ref: 00D2E9F3

Strings

Shell_TrayWnd, xrefs: 00D52365

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: e8907c0ee656b46f9a3e7ca8e78756929cc46c4d1a75086c698e4844aca99128
Instruction ID: 6cb498f55d01e486bf65cf6f33b6c61b076bb1c5f094cf5c08c4fa26db940d12
Opcode Fuzzy Hash: e8907c0ee656b46f9a3e7ca8e78756929cc46c4d1a75086c698e4844aca99128
Instruction Fuzzy Hash: 5AD0A9323903207EE264B370AC0FFC666049B00B11F0009027A01EA2E0C8A0A8008A74

Function 00D52322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D5232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00D5233F

Part of subcall function 00D2E97B: Sleep.KERNELBASE ref: 00D2E9F3

Strings

Shell_TrayWnd, xrefs: 00D52325

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: a7b3cb2f33e31a708a89938d731140147cf286875c2c8bb1dfd650022561dd47
Instruction ID: 2117448fb4b2ac0933de215778ebb6ac0bb69fe2f2d20acd939b001288f14191
Opcode Fuzzy Hash: a7b3cb2f33e31a708a89938d731140147cf286875c2c8bb1dfd650022561dd47
Instruction Fuzzy Hash: F6D0C9763A4320BAE664B770AC1FFC66A149B10B15F1059167A45EA2E0D9A0A8458A74

Function 00CFBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00CFBE93
GetLastError.KERNEL32 ref: 00CFBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00CFBEFC

Memory Dump Source

Source File: 00000000.00000002.2934115833.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2934086184.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934198835.0000000000D82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934266104.0000000000D8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2934297079.0000000000D94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: ccd7953dd70baefb924fe42e12e3018d44d5c5fabb031d13c6cac2d15a58e6a1
Instruction ID: 8f2cb6bdb249a4bde271d8a057455b3193ddf95eed13b5b5d9855685f1ee49be
Opcode Fuzzy Hash: ccd7953dd70baefb924fe42e12e3018d44d5c5fabb031d13c6cac2d15a58e6a1
Instruction Fuzzy Hash: 1141E93860034AAFCF61CFA5CC44ABA7BB5EF41310F154169FA69972A1DB308E01DB62

Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725401059&P2=404&P3=2&P4=MxlQetuhUPn2VzEHyWRBdPw7qKVTSjO5MfGcFoXX13moZYVvVEDshPcTi2HhKix7UY3xZN%2bt%2fR54Qv9qr6P19g%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: hozn6PEXnaT/StLG+PD2A0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=e1nCET6+FHWRer1&MD=bT15VvgP HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725401059&P2=404&P3=2&P4=MxlQetuhUPn2VzEHyWRBdPw7qKVTSjO5MfGcFoXX13moZYVvVEDshPcTi2HhKix7UY3xZN%2bt%2fR54Qv9qr6P19g%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: hozn6PEXnaT/StLG+PD2A0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=e1nCET6+FHWRer1&MD=bT15VvgP HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.228

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2df4d02e-040d-43af-b659-e131697e9b66.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\350915e4-ce30-462e-b1b5-e47d0a101e53.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4c96a09a-177b-42fa-8dd1-89dd5ec6370f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5fc38298-c324-4aa2-9e01-6d664005f7e7.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8dc42786-92e1-4d74-bc09-b035aa24ce51.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\b8c64817-1fc6-405f-bd9b-187263417804.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66CE4D4D-1D64.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66CE4D4E-1E68.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\097a5377-7550-41e9-a588-bacf9ebaf5cc.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1b47d099-a4a1-4bb7-b2c2-f95ec7d98785.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1d4e96d6-e791-4c40-b3a7-696eb05d1a51.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\741dca0d-2efa-49f9-a261-a34b774a6eb6.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\8b5bb577-035d-404b-834c-e1cf28391ab6.tmp

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre