Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1500446
MD5:	b5a6e633330ede88b76777532223017b
SHA1:	7f02397384b237520a6f91678be73d9c75f106e5
SHA256:	dd1074b75f93e632e7b78b5504fe07d4bcfcbc71759c779394c0efe5b572ce51
Tags:	exe
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B5A6E633330EDE88B76777532223017B)

msedge.exe (PID: 7432 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7684 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2036,i,8244173098469223408,5873798971451849439,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7696 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7980 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8816 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3412 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8824 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3428 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8900 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7280 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7280 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9212 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7500 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9036 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4300 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9496 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6044 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9504 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6044 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9952 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 10160 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2064,i,3874761813740752190,4412825139045051172,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8596 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8600 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2008,i,5910061952116798662,9188178210013363448,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8360 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9860 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2052,i,8898610241083632541,3764320059001856009,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Length: 326Content-Type: text/html; charset=us-asciiDate: Wed, 28 Aug 2024 11:52:01 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.09ac2d17.1724845921.e2448c2Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: *Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin: *

Source: file.exe, 00000000.00000002.2893210517.00000000010E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.11.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.11.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.11.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 489a8b5b-31d4-4649-a815-648cbf012599.tmp.12.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.11.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 489a8b5b-31d4-4649-a815-648cbf012599.tmp.12.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.11.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: file.exe, 00000000.00000002.2893142258.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: content_new.js.11.dr, content.js.11.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 489a8b5b-31d4-4649-a815-648cbf012599.tmp.12.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49794 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0077EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0077EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0077ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0077ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_0077EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0076AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0076AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00799576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00799576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_bc04dcbd-5
Source: file.exe, 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f63e06fd-8
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_4d9e5ef6-1
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_9fcdb4d8-d

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0076D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0076D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00761201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00761201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0076E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0076E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00708060	0_2_00708060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00772046	0_2_00772046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00768298	0_2_00768298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073E4FF	0_2_0073E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073676B	0_2_0073676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00794873	0_2_00794873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070CAF0	0_2_0070CAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0072CAA0	0_2_0072CAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0071CC39	0_2_0071CC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00736DD9	0_2_00736DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0071B119	0_2_0071B119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007091C0	0_2_007091C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00721394	0_2_00721394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00721706	0_2_00721706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0072781B	0_2_0072781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0071997D	0_2_0071997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00707920	0_2_00707920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007219B0	0_2_007219B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00727A4A	0_2_00727A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00721C77	0_2_00721C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00727CA7	0_2_00727CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078BE44	0_2_0078BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00739EEE	0_2_00739EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070BF40	0_2_0070BF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00721F32	0_2_00721F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0071F9F2 appears 40 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00720A30 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00709CB3 appears 31 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.evad.winEXE@94/524@22/13

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007737B5 GetLastError,FormatMessageW,

0_2_007737B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007610BF AdjustTokenPrivileges,CloseHandle,		0_2_007610BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007616C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_007616C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007751CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_007751CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0078A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0078A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0077648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0077648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007042A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_007042A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\fd6d1f14-c91e-4b13-8964-92401dab85e8.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.11.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2036,i,8244173098469223408,5873798971451849439,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3412 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3428 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7280 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7280 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4300 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6044 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6044 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2064,i,3874761813740752190,4412825139045051172,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2008,i,5910061952116798662,9188178210013363448,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2052,i,8898610241083632541,3764320059001856009,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2036,i,8244173098469223408,5873798971451849439,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3412 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3428 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7280 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7280 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4300 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6044 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6044 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2064,i,3874761813740752190,4412825139045051172,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2008,i,5910061952116798662,9188178210013363448,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2052,i,8898610241083632541,3764320059001856009,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007042DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_007042DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00720A76 push ecx; ret

0_2_00720A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0071F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0071F98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00791C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00791C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-96396

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6500

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.9 %

Source: C:\Users\user\Desktop\file.exe TID: 7420

Thread sleep time: -65000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6500 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0076DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0076DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007768EE FindFirstFileW,FindClose,	0_2_007768EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0077698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0076D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0076D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0076D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0076D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00779642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00779642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0077979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00779B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00779B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00775C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00775C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007042DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_007042DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-96036

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0077EAA2 BlockInput,

0_2_0077EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00732622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00732622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007042DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_007042DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00724CE8 mov eax, dword ptr fs:[00000030h]

0_2_00724CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00760B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00760B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00732622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0072083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0072083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007209D5 SetUnhandledExceptionFilter,	0_2_007209D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00720C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00720C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00761201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00742BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00742BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0071F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_0071F98E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007822DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_007822DA

Source: C:\Users\user\Desktop\file.exe

0_2_00760B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00761663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00761663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00720698 cpuid

0_2_00720698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00778195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00778195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0075D27A GetUserNameW,

0_2_0075D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0073BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0073BB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007042DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_007042DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00781204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00781204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00781806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00781806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
s-part-0014.t-0009.t-msedge.net	0%	Virustotal	Browse
chrome.cloudflare-dns.com	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com/crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://msn.com	0%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Virustotal		Browse
https://www.office.com/Office	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Virustotal		Browse
https://www.google.com/chrome	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Virustotal		Browse
https://www.google.com/favicon.ico	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0014.t-0009.t-msedge.net	13.107.246.42	true	false	0%, Virustotal, Browse	unknown
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.250.184.225	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	URL Reputation: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.11.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://msn.com	data_10.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content_new.js.11.dr, content.js.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json0.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	489a8b5b-31d4-4649-a815-648cbf012599.tmp.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://myaccount.google.com/signinoptions/passwordC:	file.exe, 00000000.00000002.2893142258.0000000001020000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.42	s-part-0014.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.111.84	unknown	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.40.132	unknown	United States	15169	GOOGLEUS	false
142.250.184.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.200.0.9	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.251.35.174	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.165.142	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500446
Start date and time:	2024-08-28 13:49:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@94/524@22/13
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 43 Number of non-executed functions: 312
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 66.102.1.84, 204.79.197.239, 13.107.21.239, 13.107.6.158, 2.19.126.152, 2.19.126.145, 142.250.186.67, 142.250.185.195, 2.23.209.178, 2.23.209.177, 2.23.209.172, 2.23.209.171, 2.23.209.176, 2.23.209.174, 2.23.209.168, 2.23.209.170, 2.23.209.173, 20.74.47.205, 142.250.186.174, 2.16.100.168, 192.229.221.95, 142.250.185.138, 172.217.18.10, 142.250.74.202, 142.250.185.170, 142.250.186.170, 142.250.185.106, 142.250.186.106, 142.250.186.74, 142.250.185.234, 216.58.212.170, 142.250.184.234, 142.250.181.234, 142.250.186.42, 142.250.185.202, 216.58.206.74, 172.217.16.138, 142.250.65.195, 142.251.40.99, 142.250.80.67, 142.251.35.163, 142.251.40.163, 142.250.65.163, 142.250.80.35
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, iris-de-prod-azsc-v2-frc-b.francecentral.cloudapp.azure.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net,
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:50:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
12:50:09	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
12:50:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
12:50:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.42	https://protect-us.mimecast.com/s/FVibCzpzxLsxEMXAhgAOBC	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
	http://border-fd.smartertechnologies.com/	Get hash	malicious	Unknown	Browse	border-fd.smartertechnologies.com/
	https://protect-us.mimecast.com/s/4MrPCrkvgotDWxrNCzxa8p	Get hash	malicious	Unknown	Browse	www.mimecast.com/
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0014.t-0009.t-msedge.net	http://conrasty.pro/rd/4GZfNu661Wcuf128ryymsulvqg219KJAPMAHPZPNXNLR15619WARW973R13	Get hash	malicious	Phisher	Browse	13.107.246.42
	https://www.ispringsolutions.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	Apponde2.exe	Get hash	malicious	AveMaria, UACMe, XRed	Browse	13.107.246.42
	https://emea.dcv.ms/haHCQHi4RD	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	http://pub-d8a6d29ea9874e96bef04fb25c6e2440.r2.dev/vertical.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.42
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	https://support.microsoft.com/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	https://www.google.com.uy/url?q=//www.google.tn/amp/s/2kk8g.ubpages.com/ca10b7ff663b7dafeisla8zrrihpgxhbip2lby0aqo	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
s-part-0032.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://urlsand.esvalabs.com/?u=https%3A%2F%2Flinkin.bio%2Falbatros&e=606d87ee&h=dea68a16&f=y&p=y	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	http://conrasty.pro/rd/4GZfNu661Wcuf128ryymsulvqg219KJAPMAHPZPNXNLR15619WARW973R13	Get hash	malicious	Phisher	Browse	13.107.246.60
	https://www.ispringsolutions.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	UploadCustomersTemplate(2).xlsm	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://emea.dcv.ms/haHCQHi4RD	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://iv1tm.ykrbkt.ru/iV1TM/#hans.wurst@us.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://iv1tm.ykrbkt.ru/iV1TM/#hans.wurst@us.com	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
sni1gl.wpc.nucdn.net	https://iv1tm.ykrbkt.ru/iV1TM/#hans.wurst@us.com	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://silverangelshomes.com/res444.php?4-68747470733a2f2f684a456d2e6c64656e626572616e2e636f6d2f4d33306830536a4f2f-	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Scanned copy payment.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	pcsx2-v2.0.2-windows.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	qbvytVOPN0.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.84.50
	https://nr-srpack-dk-payment-conformations.fushenq.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	CcPVItZy6w.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	709876765465.exe	Get hash	malicious	DBatLoader, FormBook	Browse	188.114.96.3
	f8Y5y07yHi.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	172.67.166.231
	qbvytVOPN0.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.42.119
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://silverangelshomes.com/res444.php?4-68747470733a2f2f684a456d2e6c64656e626572616e2e636f6d2f4d33306830536a4f2f-	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://urlsand.esvalabs.com/?u=https%3A%2F%2Flinkin.bio%2Falbatros&e=606d87ee&h=dea68a16&f=y&p=y	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	709876765465.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.107.137.11
	http://conrasty.pro/rd/4GZfNu661Wcuf128ryymsulvqg219KJAPMAHPZPNXNLR15619WARW973R13	Get hash	malicious	Phisher	Browse	13.107.21.237
	https://www.ispringsolutions.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	UploadCustomersTemplate(2).xlsm	Get hash	malicious	Unknown	Browse	150.171.27.10
	UploadCustomersTemplate(2).xlsm	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.67
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://silverangelshomes.com/res444.php?4-68747470733a2f2f684a456d2e6c64656e626572616e2e636f6d2f4d33306830536a4f2f-	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://urlsand.esvalabs.com/?u=https%3A%2F%2Flinkin.bio%2Falbatros&e=606d87ee&h=dea68a16&f=y&p=y	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	709876765465.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.107.137.11
	http://conrasty.pro/rd/4GZfNu661Wcuf128ryymsulvqg219KJAPMAHPZPNXNLR15619WARW973R13	Get hash	malicious	Phisher	Browse	13.107.21.237
	https://www.ispringsolutions.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	UploadCustomersTemplate(2).xlsm	Get hash	malicious	Unknown	Browse	150.171.27.10
	UploadCustomersTemplate(2).xlsm	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.67
EDGECASTUS	https://urlsand.esvalabs.com/?u=https%3A%2F%2Flinkin.bio%2Falbatros&e=606d87ee&h=dea68a16&f=y&p=y	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	Remittance_Details_#20O8N7B.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://emea.dcv.ms/haHCQHi4RD	Get hash	malicious	HTMLPhisher	Browse	152.199.21.118
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	https://my-apps-885d2a67.azurewebsites.net	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.54.161.105
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42
	https://iv1tm.ykrbkt.ru/iV1TM/#hans.wurst@us.com	Get hash	malicious	HTMLPhisher	Browse	23.59.250.25
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.54.161.97
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.9
	file.exe	Get hash	malicious	Unknown	Browse	23.54.161.105
	https://newbostondentalcare-my.sharepoint.com/:b:/g/personal/maryellen_newbostondental_com/ERDvxS5UJSxPtXyWuklCyAMBDYWal6mJXrTJHUf_OfHqfg?e=5l0sTu	Get hash	malicious	Phisher	Browse	23.54.139.47
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.38

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://silverangelshomes.com/res444.php?4-68747470733a2f2f684a456d2e6c64656e626572616e2e636f6d2f4d33306830536a4f2f-	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	https://interprimesolutions.com/imp/ns/?hg=vndankxgbdow&vn=ujdgsmfdd2RjQGFsLmNvbQ=	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	https://urlsand.esvalabs.com/?u=https%3A%2F%2Flinkin.bio%2Falbatros&e=606d87ee&h=dea68a16&f=y&p=y	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	https://nr-srpack-dk-payment-conformations.fushenq.com/	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	https://www.ispringsolutions.com/	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	CXWk52EmUt.exe	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	CXWk52EmUt.exe	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	Remittance_Details_#20O8N7B.html	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71520
Entropy (8bit):	6.072638524519426
Encrypted:	false
SSDEEP:	1536:iMSzvKYqstxiAoc1EKuhJM9t9ztCfUuu8EI0B9wgpfg1DJG7GmmTtzXFKj0z:iMS2dKIdKUMJRu+dBiga1DJKGmQtzXFJ
MD5:	B5EBDF3F66BB3A74B0A1E516D82CB76D
SHA1:	A21F07C5F033C5AF35D983A637CDD01B6EFF82B2
SHA-256:	09D716547E7B9E2D9D3F30CD9CB1DA4D26648FD64D44CA14A05AD0E5A089E5F6
SHA-512:	A63DB31823FC1E4A5F55F4796CACF10F92AF0E86EE074DF338EA1CE78CBE9097A76CEB1B08280A9D333CA9E7F3233BAF2AFC430757A2F629D889A25123620F7E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369319395187354","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2ef2b9a3-bf70-42eb-a558-c69293cc419b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.592564568329289
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afHnM2kLVko+jtSvkHB+udrxEdVvBij1ZnRf5aJkXacK+wlR6:Xq8NkC1fHMpLVkomSGBPWdVvop/fkJkH
MD5:	AD2B68C0E28F82333A27804AFE707D2F
SHA1:	129AAC6CA35507CDFBE0504B80764DFC28B483F0
SHA-256:	D0F1493598108AF259CC1A0D53660F4974D9F196B6D7A5D79B039E97ECC45075
SHA-512:	1FB656250D93053CE09A5107F05E4E0814EAA399EA97A1BC880EE2F55DAE39A0DFB43BBA7406C4269C523CC8ABFEBD0365738742F19A4BC897D44BB005D38A2B
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"policy":{"last_statistics_update":"13369319393986119"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4b1d6820-7f4a-4d05-8a6b-c9c4d2c79236.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	5.613017674029643
Encrypted:	false
SSDEEP:	96:0q8NkC1fHMpLVkomS4xBPWdVvop0+BJkKc4SDS4S4SDSmFI4a:/8NbhOLVko8eg0+XkK0
MD5:	A1625D9F2E9C8706C517B6F280EED6E2
SHA1:	3CC1C120FFEED63FBD4E4DB1B86FB46D19EDADA3
SHA-256:	2DAB2E22F12BF7D17A3900B6E1A08B394B2273CCC530027FD711277481C54D83
SHA-512:	D3CE844407D1F5A47ABBE98A08F835D6E429FDF04F31FF04B89DD88D5916AF26BC6C5A236AC458C2A103F2154B90CE4962E50C58682D28E5B623E187351E8E16
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4e72844c-b573-4072-8f0c-b285bc2e922d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.499138120546808
Encrypted:	false
SSDEEP:	96:0q8NkGS1fHMpLVkomS58rh/cI9URoDotoxrBPWdVvop0+BJkKc4SDS4S4SDSmFI7:/8NBShOLVkoueoDUseg0+XkK0
MD5:	E41D1D598F9E39CBFAF6F953D6EA119E
SHA1:	45A715A8CB88B5C8207237122D30597DC12A3A05
SHA-256:	51088CEB37574A2C948C16A91E5C8137261A7C0BC2FCBDB908B098A96BDDBDF3
SHA-512:	F971A75D5F495710D8A4F381C67B15BB356F5266B351C35AA7708490F82725C10362FC8FAF1721CC6A234CEAC496906986B63452137F2989567BD247A039A304
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3c

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\53cab272-152b-4ce8-8e09-92b882dfc629.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20983
Entropy (8bit):	6.064775823886492
Encrypted:	false
SSDEEP:	384:utM7XKnG7EtlXrjYJUoLUJqHsdZsJHaV8NBSUaaSoB8DguUK7qkR7FvA4fiBVSWf:iM7X2zt1jKYqHkZeM0So6DguUKugvFaz
MD5:	FD9F17A04E7028A7A53A64BC689FAC2A
SHA1:	912B1ABD03DBED062306FF318E9184C6B2FAEBBF
SHA-256:	5626AA75C5C4DFCCC577C380736807A99CADBA648E1DC928F8109DE32CA0F9A8
SHA-512:	2D55AA14800879AB2874B6550C112C674DCAA8CDDC53A4B74AAB876B1A71B7956F8DB27BBC642A8F71B1841DB14D016BB1B05F4DB774F9A4E4EA212A06890519
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369319395187354","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\604ad75a-fdc1-46cb-843e-d156c2817be8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20982
Entropy (8bit):	6.064812347955954
Encrypted:	false
SSDEEP:	384:utM7XKnG7EtlXrjYJUoLUJqHsdZsJHaV8NBSUaaSow8DguUK7qkR7FvA4fiBVSWf:iM7X2zt1jKYqHkZeM0So1DguUKugvFaz
MD5:	1BEAB7FBD107345F38D995B8CCE03A8F
SHA1:	2CF24889B2AE7EA0255725764F23EE4F0C4E7CD4
SHA-256:	A7254604C4FF31E23223A9D6AB952AFCEB43E856D8F49862EAFA5D6AF373FE09
SHA-512:	4AAF90613BF3601F6A8A323FBD6AA233BBFF3420BEC5EE9A548FE845502A1E1952A7749C9407710FDDD6BBED394E04DBA5B6977193B4FAB7F1C2A7CCEB42E5A3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369319395187354","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6c6bd348-1521-4ec9-acb1-68512afc44ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.552339259592703
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtKGjnxabhskLVkFO+phtiyikiuoJdXBuBuwBiaAK0FKNh7TX6/:YuBqDPafHnM2kLVko+jt4vgBzBij1K7W
MD5:	D93169BDD755817D9D8E7D46779D1137
SHA1:	E53C754AACD56522C6BF686E1D2CD9425C4AA83E
SHA-256:	026B328E30FB24660CDD35A637721ABDEBB7F41B0A54C0F515CD9AB1ADCCFB7F
SHA-512:	69EFEFB6DFA3484D487F65658159582A728301C29D9E3FB736FF1404B8B64E2F5817EFA404309D36F77C29BF1C5CF511D3EB50AD17A40697D95D925854F68225
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369319393933435","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724845793"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\9899878a-70fb-4968-86b8-da849062cc78.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24335
Entropy (8bit):	6.054487407279504
Encrypted:	false
SSDEEP:	384:utM7XKnG7EtlXrjYJUoLUJqHsdZsJHaV8NGUaaSoB8DgSXqdqVEtz49iFK7qkR78:iM7X2zt1jKYqHkZeMKSo6DgSEtz49iFV
MD5:	21371797812B7F4715046AA05564DE63
SHA1:	D05756982770A0527082BCD4FCEA14AE00B16733
SHA-256:	E7D5502306A50785D61BBC0D52BB1DFFBFA1768A63C0F622AF06D27B74B618B1
SHA-512:	403B58A3CED96E1C08F8416D989C07B702FD2A494586A23B946F579799E1E60560C7446F16E4D0E54B30224DDA19FB5D23B6F7BA5D084AA5F4201F5558DFF4D5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369319395187354","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640169812365318
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7g:fwUQC5VwBIiElEd2K57P7g
MD5:	D317A1069717AF45FC861714DD0A22C5
SHA1:	35541055A1413A913A3367FBEC466E4B7ABC21A6
SHA-256:	5575BEA8664FF1D946BDF20A229510DB85D24B8722CBFBD0DC77583D93900EF3
SHA-512:	ABDDB701867F9D4322511ED7E2DC8EF0596C11CE6573F0CF1469C527B27CD13BADCA877E53050200FFAF4CC0269CDAA1AF4B885A1BE30364C44026DBD89667F3
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\f17172c5-dfec-4811-8901-a5909b1be7d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640169812365318
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7g:fwUQC5VwBIiElEd2K57P7g
MD5:	D317A1069717AF45FC861714DD0A22C5
SHA1:	35541055A1413A913A3367FBEC466E4B7ABC21A6
SHA-256:	5575BEA8664FF1D946BDF20A229510DB85D24B8722CBFBD0DC77583D93900EF3
SHA-512:	ABDDB701867F9D4322511ED7E2DC8EF0596C11CE6573F0CF1469C527B27CD13BADCA877E53050200FFAF4CC0269CDAA1AF4B885A1BE30364C44026DBD89667F3
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66CF0EE1-1D08.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.040485239716101434
Encrypted:	false
SSDEEP:	192:8hUjLYiVWK+ggCd1bJtD+1X9X1hoUgV8vYhafvNEfbcRQM96X7n8y08Tcm2RGOdB:KUjjln63anhIuQ4X708T2RGOD
MD5:	630D6726AC7719FAD9107B22CA0AD253
SHA1:	99DDA07046EDCA1DDE3A915F31673EA829DC6649
SHA-256:	087BB999F3BF49F8612A6A45F5F0C66A2D5A0BF6119F6B3CEE466A31D243FD00
SHA-512:	5CA47C0B6BEDF536F336498113735CA5E3230151336EACDB03C077F3F3C75A2BDDB0328E9E3502316D5BBB5752183E4D5CB4D5D0246365088CD7E38F1931AD0F
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".yxrbec20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............9.....................$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...%...Ck@@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66CF0EE2-1E10.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4595277422580284
Encrypted:	false
SSDEEP:	3072:BVgI3tzDB13BfqMSmCFhmKJGM06Hy/lS1CZeff33n9F0c2nhlg1HFym0qzmtlCG9:3d/CBsnhlaHa1xYehtaH8mnLmuf1
MD5:	E6F30E81063BDF52B98633EDD8D8BBDE
SHA1:	64DA20287DC7BA9FCE818708B41392F286BE0C06
SHA-256:	DC8E8B42B3DCE204C97945244453962E4DBE4ADDF3BA1C5C6D3A4CC37DEBDEEC
SHA-512:	E9F6FB7DA956911E0C1B3E88E724491E76F0D532DAEDCEBB0E547C5422CBCC87068A100CDE45193BA99A4E07A8D286F5F2C6985CD4C216B01548EE74D83F0774
Malicious:	false
Preview:	...@..@...@.....C.].....@................e..0e..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".yxrbec20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.1644959986916925
Encrypted:	false
SSDEEP:	3:FiWWltlrow3Y1Gm3IHSRqOFhJXI2EyBl+BVP/Sh/Jzv0T1KEhfQHuFGllkl:o1r3XAIyRqsx+BVsJD0ZKGKuFG/s
MD5:	32A1084C3D6139F16CA908F9EC1FABA3
SHA1:	B9459AF94E19AAAEC86F2C8C8D9AFF0521ABECF7
SHA-256:	BE9297B2EE00EFE207DE6958BE8857525FC1117F45708FD66BA7CDEEA21A76C5
SHA-512:	0889FDCB61CF47F9B0BEA6ABAEA50EFF422E85AC833501C1A20E11052568A6E5D9E3F91B64705649B62BDEE1B82ABB7902D6096ED5A4220039A160900EAD1AA1
Malicious:	false
Preview:	sdPC....................*.Up.<M....=.`."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................f706681c-6dcb-4388-a52b-c1f5b0a206e2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\22d57165-0ae6-4930-9b91-cf66638d69c2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\2c695320-6ec7-49e0-9d8f-affe1a8fbce8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.982689019630715
Encrypted:	false
SSDEEP:	96:st+qfRis1rb9/+xBN8zjs85eh6Cb7/x+6MhmuecmAeAqTQp2MM/EJ:st+XsaxBNkjs88bV+FiAC6PMMJ
MD5:	F668E8981814E8B0B2BEF16A806E9D2D
SHA1:	CAE240AD93842FAD20DEB70391ADDD0D1283D680
SHA-256:	7818872FC0A33A8D49A7DAD1928A0D57AB9FDCA69C19AF29E2A84656995059BE
SHA-512:	2B0F1E67201B695B5AF48C43DAA48FC0EAF7D9CEB4CF487C757440798EDAB24DDD561C1FB221B8A790B73E0F5EE6E93E2E79BADBE9CE8434C6C4D28241AA3A99
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369319394975826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369319394982852"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\71549a94-285a-4d34-8a85-75a5167cc8d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\9578bcaf-8fce-4633-b4d5-641be12490bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566093247004063
Encrypted:	false
SSDEEP:	768:mE43ncWPO8fk/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjSOmJrwppGtuL:mE43ncWPO8fk/u1jaK7m6mtw
MD5:	2F7BB4B345CA9D08F595F72BDD4F8726
SHA1:	7932E2982B0E0BAD38525A9CD07523A99B857399
SHA-256:	5E30E93086EA21DBD62826601DDA5A14247675E96F7545E58A8B2E2573A59CED
SHA-512:	A43D16C919AA16803D5139EB7DDF111F775F60BF755BCCA2CC6ECA39567D917E86869B8D1CA03082551D25B19C376CF34D711729FD17CA7EF07174D03881E9DE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369319394457644","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369319394457644","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\9faff24d-16f5-4c60-b78d-ca04d5b1c63b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	4.9851835784026735
Encrypted:	false
SSDEEP:	96:st+qfRis1rb9/+xBN8zjs85eh6Cb7/x+6MhmuecmAeAquQp2MM/EJ:st+XsaxBNkjs88bV+FiAClPMMJ
MD5:	F1F2F9BC12F132BB32002E2ED5550625
SHA1:	2F4EB2C0ECECACD00BF9522003C23881A3A81592
SHA-256:	8FA2ACAFF2E6E35148660A167261B02CD35AA7696375A8CE898605E5A1444847
SHA-512:	C55331D736ACB2A272A241CFCC22E688763B14C795CA2211923D8A3EBE2BDE5B205E587F1459963A8916B01BADB7D713A46A6E4F90196AA77BB4AF115B570A66
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369319394975826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369319394982852"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321089951715615
Encrypted:	false
SSDEEP:	192:dAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:GOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	9AC3CBC6693B991A787F28C4537E5EBF
SHA1:	253AEEBF6ED12ED664945DD46BDA66EF37000AF3
SHA-256:	EB1EF4E23385441CDC125BAECCA9DFE5D07E75306A53BCDC0645D28762FAEDAD
SHA-512:	B876A36C446FD92B17ED3E5018FA5C9388B89E751EB2036A1A59DE4D8A5B71864A8417E04351A7D8D3E2FD5B94AA6F693A0C1D10043F5041FDA08E7732D006DD
Malicious:	false
Preview:	...m.................DB_VERSION.1..Q..................QUERY_TIMESTAMP:arbitration_priority_list4...13369319399581558.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.140297509093523
Encrypted:	false
SSDEEP:	6:NdC0q1wkn23oH+TcwtOEh1ZB2KLlLgEAVq2Pwkn23oH+TcwtOEh1tIFUv:Nd5fYebOEh1ZFL10vYfYebOEh16FUv
MD5:	B809167B2C40B7637EE9282F6F7FCCA8
SHA1:	D5696ABFBF461FCA34EC24A4789A600E9FC06FF5
SHA-256:	EA2E2AB921A6C082FE1859FE371D7F935BA83800DAA043A85FEF36DA065D39E3
SHA-512:	B225E1C3A62995C5CEFCBDDADF7F022F6B483F84DEAB413E359AFD850936E4F8A6DA6521847405DB4F3BF85DA8D8D7CE5F7F6002F8AF5725662637AC10C1C588
Malicious:	false
Preview:	2024/08/28-07:49:58.864 2290 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/28-07:49:58.926 2290 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.044416779680992946
Encrypted:	false
SSDEEP:	6:/Fii2KkM/lOZ+9jGfqMtzDbAY+kll8h8H/lo:d4EOZpfqEHbNz/ZN
MD5:	0FBEC19C9EBD3B227F3362369C769A62
SHA1:	38F31260DAB093AFEFE8307F79C8C7C7DA2B89EA
SHA-256:	BA2F27D31CB6203B047AC4597192000F8081E59F759CF7EE0E36F6D7B28A7A6C
SHA-512:	3A9BBE7BDB11372CFC761A90D77D7A373F7E0493404489B022A51D3588404D901BB3C86D379E299A3A12611256C2B4B721CFB7AA3AB57D42329B258D1DC7B794
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09560851186684635
Encrypted:	false
SSDEEP:	48:sV4A3esEwV4XesrAAY6NUeG6CQUT3lWp4:sV4A33/V4X3rAF6NLG6Y3L
MD5:	325A1130F14877C4EC41A9A49B16E851
SHA1:	D5571F970BEA4ADED46D80341C03640D26D9367A
SHA-256:	FFDDD2A2E94045574258BAD5D5CEA2E4301B3DECE8DE75C9BD24E4CD6B9F254A
SHA-512:	D57B55B525FB9515836AA68535D76F82C95B53398F05078F8BBD44CA48726FEB13431ED8E615D95CDFA628BA8F46C4ABEF3770FCAB1EBEDFA6D9EAD1D455CEA8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.28350440651371617
Encrypted:	false
SSDEEP:	768:njn2IJt0jn2IJtirQjD8JtDrQjD8JtqX5Jt:
MD5:	0A09952632534BF4A9274B7C1BF3513A
SHA1:	CD5AB51BDEC2B3DD81E99E99C7094F86B137F19C
SHA-256:	16ECA34F27066ADAE596EE0AA08F0A5BDD1152739FB269000400221FA9F1B3C6
SHA-512:	038B82E78A701BF9F388EEEA4E99EAFCFB6498E7A93E89F2BB500147848B9757F7A9108C37A2F628BA7591A3DF67CAB70B00418A55B7B22C95AB9F8D7C8A4963
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsuldyl:Lsbl
MD5:	A08D431CBE11FF6AEEEC160118F8210F
SHA1:	835134613E8F014E60340C99F0D100CB0E302492
SHA-256:	D01AC61AD4FB98303B6C41805DC976B33D9063D826AA2289FCD0FB340502ADA0
SHA-512:	905EBDE0A000934440B873FD2AE11A35E8D11C4D76C68B39BBD1B21E26FCFBB57918EE646DF21ACE847C7C3316A605E239F3528B0E6EFB3DD4886ABD6D2FEE83
Malicious:	false
Preview:	........................................L..=S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:c2IKaE14K9Kl:c23114o+
MD5:	B236A5281BCE05A88B8B16CAA17C4C6E
SHA1:	E06DF4F5D9A10B10B2071EB93CEAA17E651E4A91
SHA-256:	DE2FEF064F4CB6BDA9C710AFB903629F9931FA6E3000F1B2DD84F16AB28D5DF2
SHA-512:	8576185062B919CC4B13EEA8AD983A5471F1664F7EC6D62CC9CE65655C378735FC8EFC48E0DCDA352383164C0862C06B448F45A099463E4DC0CB1CF2743167DC
Malicious:	false
Preview:	(.......oy retne.........................]h=S./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:c2IKaE14K9Kl:c23114o+
MD5:	B236A5281BCE05A88B8B16CAA17C4C6E
SHA1:	E06DF4F5D9A10B10B2071EB93CEAA17E651E4A91
SHA-256:	DE2FEF064F4CB6BDA9C710AFB903629F9931FA6E3000F1B2DD84F16AB28D5DF2
SHA-512:	8576185062B919CC4B13EEA8AD983A5471F1664F7EC6D62CC9CE65655C378735FC8EFC48E0DCDA352383164C0862C06B448F45A099463E4DC0CB1CF2743167DC
Malicious:	false
Preview:	(.......oy retne.........................]h=S./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:yjp9Eab:yFqM
MD5:	9D3621ED2AC410BE876F9327FA021B03
SHA1:	64A442B964983BFE6E5E7D4F7845AD712F4FFC06
SHA-256:	FCD0DED6625EFC5C6DC14F38629E502A86C4F45947A96A4FA206AFEF6AEA91C7
SHA-512:	CC2C5978F219175C0998327504BA1374F87AB737A39477DBB51D1A7B6BB26D708CA1645EB93A82CC44875EFCFB32868F8627314DAC7E12FF77DC0FDFBCF92C51
Malicious:	false
Preview:	(...... oy retne.........................ig=S./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:yjp9Eab:yFqM
MD5:	9D3621ED2AC410BE876F9327FA021B03
SHA1:	64A442B964983BFE6E5E7D4F7845AD712F4FFC06
SHA-256:	FCD0DED6625EFC5C6DC14F38629E502A86C4F45947A96A4FA206AFEF6AEA91C7
SHA-512:	CC2C5978F219175C0998327504BA1374F87AB737A39477DBB51D1A7B6BB26D708CA1645EB93A82CC44875EFCFB32868F8627314DAC7E12FF77DC0FDFBCF92C51
Malicious:	false
Preview:	(...... oy retne.........................ig=S./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	8.736218952347586E-4
Encrypted:	false
SSDEEP:	3:LsNl3:Ls33
MD5:	E874E3F1D8988DE6B7C7CAF81A71CE19
SHA1:	34FF2E77D73D57196F8854A3E5ADF0FD33C7813F
SHA-256:	8E40E1B4DB4610D37616B8209A0BE2478F5E37B43392C9A3B1EF73274CCD7E01
SHA-512:	5DC6FABEC0CD6D1D6BBF3F9CD374AF4F72F50361B9300117D982A4F1B3924DEF266C5EB9B4A1DE0FB015D9199D5162A67129573E85F49184F37F44C7AC6FB617
Malicious:	false
Preview:	..........................................{=S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	375520
Entropy (8bit):	5.354152085340504
Encrypted:	false
SSDEEP:	6144:iA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:iFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	59FD6139961EE1DA4CE94813D590EADC
SHA1:	0E7773CF2E4C1CDE6647B92F80F8C202F086C1D3
SHA-256:	AF82EAC736258332F71C8318A8B5836F69709D3582B5C5B63EF0D7CCF8E1F1FD
SHA-512:	7C85297E00E9C31F9B63837D3520046B5DC37760FE6A232178806107C7A8E9540883283819188ECEDA844A5EB1824B565CE387A4B189C3B5109B2457E6F81E75
Malicious:	false
Preview:	...m.................DB_VERSION.1~...q...............&QUERY_TIMESTAMP:domains_config_gz2...13369319399635386..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.216874445047722
Encrypted:	false
SSDEEP:	6:NYEGR1wkn23oH+Tcwtj2WwnvB2KLlLblWM+q2Pwkn23oH+Tcwtj2WwnvIFUv:No0fYebjxwnvFL1RL+vYfYebjxwnQFUv
MD5:	AC169B896C4F4647FBC936142233E9B8
SHA1:	E3CEB0777166C0A4479EFCD30748567D61AC5075
SHA-256:	847B023638908993BAD832F38B34AFD498EA71777594E55B5BE1AAF0EE6602AD
SHA-512:	39632D134A8380D5D306E3C8ACD85C41BA216FBF6C0F5C283111C5A392D064621594A2BC9B5165D9B2D99CE3D8A5ED768F5E751F68DE4681F670415BC514E5E9
Malicious:	false
Preview:	2024/08/28-07:49:58.865 22ac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/28-07:49:58.934 22ac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	358859
Entropy (8bit):	5.324609144146953
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rw:C1gAg1zfvI
MD5:	8D8D2FB5769126DA2EFB9B3110F0F9D7
SHA1:	E439C6422A9193F3F9D371D32FFA91E978C3F808
SHA-256:	D877B02B33FFE8CF9A211365A00C675A26408FB04ED625959E5AE9F82C917CF6
SHA-512:	CD7483110C19811B0F5690E44376E4DA53A3E3048412DDC46E1DD479DB7C6033F495C586E0049D148D0833A9B1955693A059748EFE23F5DDCE1AF9696A94CE0F
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.202238061089229
Encrypted:	false
SSDEEP:	6:NWS1wkn23oH+TcwttaVdg2KLlLfHjL+q2Pwkn23oH+TcwttaPrqIFUv:NWtfYebDL1fOvYfYeb83FUv
MD5:	4187F58F5ADA134D28330E9A1C6E89A8
SHA1:	8D71ADF6AC65C4C84C24F91B870635DAC7C48737
SHA-256:	83EB0CC075FCBE4AE04CB4EC24C8FA895C8763882A1EB7B724CEFC324E5233DF
SHA-512:	F828400C07F1CC8E1E1726086DCF98EF94E30A6C90A991B5227681CA7F24092107B0D1187A177ACFF9B3252F12A0B2A1674C5C567B1CDFA96A16822AC22C8E60
Malicious:	false
Preview:	2024/08/28-07:49:54.524 1ee8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/28-07:49:54.603 1ee8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.184313286826944
Encrypted:	false
SSDEEP:	6:N/D1wkn23oH+Tcwtt6FB2KLlLUMllL+q2Pwkn23oH+Tcwtt65IFUv:NKfYeb8FFL1/lIvYfYeb8WFUv
MD5:	0BEA6DDF73D08125886BCEDD8FFE01BF
SHA1:	AC2C9232BD9C9BB12D540416E05FF0A043612948
SHA-256:	4A1DE6AB12615B10A728BB3477236474A69CB693A783949A264302D9F92D6D8C
SHA-512:	35275116713897600FFDA004928E320FAC9EAAB9CE7611C040C942B6536B25674898CA2D9FD6565020186B8F726F60312CC071D50DD9CA4E3778C9B2026707D6
Malicious:	false
Preview:	2024/08/28-07:49:54.605 1ee8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/28-07:49:54.782 1ee8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.18557612000657
Encrypted:	false
SSDEEP:	6:NEgXs1wkn23oH+TcwttYg2KLlLXL+q2Pwkn23oH+TcwttNIFUv:NEgXLfYebJL1XL+vYfYeb0FUv
MD5:	258A7DC144471B3EDA8AB80397F12E72
SHA1:	17AA9B2BFD9D0E8F94B20D4F54F4BEBB6785720D
SHA-256:	2A074D5EAE923CA7888F58AD0EFFD7EA1A8823C579CEC3DC9DFEFC907D45DB0E
SHA-512:	7E9F1960FF59A61BD97F0D32D4A3D68D888DA6B7F23A56D9081C0D51E0D4C82BF977EA730BBDDC5B773503E7518164F9F8905816AE7FF530104613F862723B07
Malicious:	false
Preview:	2024/08/28-07:49:55.389 1ecc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/28-07:49:55.454 1ecc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNltTY:Ls3h
MD5:	4EC05A7986B5FE96F8892E83230494C8
SHA1:	66425F055BFF4D721471793010500F7F106619BB
SHA-256:	0DBD958DF15BD38E2A61B225B57551A6588574BE4214E4064FEFC47E74CA859E
SHA-512:	23951E15208747BA304508E087DDA033728910919374B763C2AACF68CE25008324BDDD6C0FFAED4F51F89D3F8E1439D32F4D41994A99A1F8B176A4DEB1F3F409
Malicious:	false
Preview:	........................................g.v=S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21861961848037048
Encrypted:	false
SSDEEP:	3:Q7ntFlljq7A/mhWJFuQ3yy7IOWUdi4/dweytllrE9SFcTp4AGbNCV9RUIaU:j75fO3T/d0Xi99pEYx
MD5:	FCD37ED1C25CE7AE1E67334031DF1B76
SHA1:	EACEF761A434E1B7785D45E49766C93D282AB0BC
SHA-256:	73B42F9FC258FC841425E052DA78DB5620012E4F3E653B52CEF8C1772C9E24A2
SHA-512:	842BEFC8982340BF9941EE613B09FBBB1663603D68448F84FE242478DB66C915A35FD7C99E01E0D934F07C88C8BC767C697780D7A318244D36BD80FF00A22D30
Malicious:	false
Preview:	..............{1...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.235228930732462
Encrypted:	false
SSDEEP:	6:NGD1wkn23oH+TcwtRage8Y55HEZzXELIx2KLlL0lyq2Pwkn23oH+TcwtRage8Y5i:NGyfYebRrcHEZrEkVL1tvYfYebRrcHEz
MD5:	A8C7FBDBC7FE15E593A4C28900C5CC24
SHA1:	86CD13DB820D6EC564C2AA141CEABD42C7998D1B
SHA-256:	7D1CD93D52FA852510FEDB3CA055202BD6A308CBB12F2F23E2E1ADABB4FCD6BE
SHA-512:	E63B69AFF749CF523CE705FE26C25734C37BEF0061D72088B2E06EE27991E25235CA689B1EFF49E88CE8583065A54FD6765B67098532817A501E6D08A7AED1A5
Malicious:	false
Preview:	2024/08/28-07:49:56.888 1ea0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/28-07:49:56.921 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.235471891193477
Encrypted:	false
SSDEEP:	6:N2Qq1wkn23oH+TcwtRa2jM8B2KLlL0aYQyq2Pwkn23oH+TcwtRa2jMGIFUv:NlfYebRjFL10aYQyvYfYebREFUv
MD5:	9DE95E29759499EDE6FC72BA5114823A
SHA1:	A54B860F3DFEC40725B301CF05AF6FE59EEF309A
SHA-256:	D87DBE24FFBAEB80E51A136C0FC408BAF9C8405DB4F0FE7E07C84A359A095DE7
SHA-512:	EFEE76A190D5E87A2BA86F018A8E3684846D5BDEC05C01E093F9572E2CB958DF0D30B1D2E4C229A39F97C6E2143EEAFAA69F6584D42A91111B7411F45DD0040C
Malicious:	false
Preview:	2024/08/28-07:49:55.046 1f90 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/28-07:49:55.069 1f90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\9fbc7c53-e11c-4e68-b65f-90ef314567a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3ad77.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7599901871520756
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkEv:uIEumQv8m1ccnvS653
MD5:	0FB600327AE7E441A760FEB9166D960E
SHA1:	30363A63BA2C117CB120AA417B32ED8D53352D46
SHA-256:	24E3AD2DBFEB2CF582391DDBB6FE53A8781306923575BB3236C19EF5B409B945
SHA-512:	D20086A85801927FDC59A26364546FCAA7487766A3B7F005AD5E4BC7A901C2D5DA0923E6B16A4A891BE310F83AA6ABAA39720647CA8C9F7665A3B36184BF31D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF28d23.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\a1b4b58b-7ba6-4635-9074-0ee1851268ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\af6c8248-67cb-4a7b-ba0e-47e27ecccd1a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\d0ff8136-d61f-4ce6-adfd-c8bcd518f371.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\ee060ee2-3492-4bb0-8769-2c587487f8f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.975637440342471
Encrypted:	false
SSDEEP:	96:st+qfRis1rb9/+xBN8zjs85eh6Cb7/x+6MhmuecmAeAqXu2MM/EJ:st+XsaxBNkjs88bV+FiAC+PMMJ
MD5:	A402AE345AA5D57E233E53A02158EEB4
SHA1:	16D46610EBF6A0F2CC8F4DA95BB6053A35E2A252
SHA-256:	198A514921A6DFFDFB46741E9722E6E2F5CD5EA097AAC0CC7E8465A38F4BE0AF
SHA-512:	8F20A6AE51DE7506A35C3529BE930C927D14B86530BC1AE568B0FB8F45AEC68926A216CE54A4FED29B6F4AE6F46B1A98E98286068342D744CEFFCA1CFF80D33E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369319394975826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369319394982852"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF31f60.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.975637440342471
Encrypted:	false
SSDEEP:	96:st+qfRis1rb9/+xBN8zjs85eh6Cb7/x+6MhmuecmAeAqXu2MM/EJ:st+XsaxBNkjs88bV+FiAC+PMMJ
MD5:	A402AE345AA5D57E233E53A02158EEB4
SHA1:	16D46610EBF6A0F2CC8F4DA95BB6053A35E2A252
SHA-256:	198A514921A6DFFDFB46741E9722E6E2F5CD5EA097AAC0CC7E8465A38F4BE0AF
SHA-512:	8F20A6AE51DE7506A35C3529BE930C927D14B86530BC1AE568B0FB8F45AEC68926A216CE54A4FED29B6F4AE6F46B1A98E98286068342D744CEFFCA1CFF80D33E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369319394975826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369319394982852"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF394af.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.975637440342471
Encrypted:	false
SSDEEP:	96:st+qfRis1rb9/+xBN8zjs85eh6Cb7/x+6MhmuecmAeAqXu2MM/EJ:st+XsaxBNkjs88bV+FiAC+PMMJ
MD5:	A402AE345AA5D57E233E53A02158EEB4
SHA1:	16D46610EBF6A0F2CC8F4DA95BB6053A35E2A252
SHA-256:	198A514921A6DFFDFB46741E9722E6E2F5CD5EA097AAC0CC7E8465A38F4BE0AF
SHA-512:	8F20A6AE51DE7506A35C3529BE930C927D14B86530BC1AE568B0FB8F45AEC68926A216CE54A4FED29B6F4AE6F46B1A98E98286068342D744CEFFCA1CFF80D33E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369319394975826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369319394982852"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566093247004063
Encrypted:	false
SSDEEP:	768:mE43ncWPO8fk/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjSOmJrwppGtuL:mE43ncWPO8fk/u1jaK7m6mtw
MD5:	2F7BB4B345CA9D08F595F72BDD4F8726
SHA1:	7932E2982B0E0BAD38525A9CD07523A99B857399
SHA-256:	5E30E93086EA21DBD62826601DDA5A14247675E96F7545E58A8B2E2573A59CED
SHA-512:	A43D16C919AA16803D5139EB7DDF111F775F60BF755BCCA2CC6ECA39567D917E86869B8D1CA03082551D25B19C376CF34D711729FD17CA7EF07174D03881E9DE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369319394457644","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369319394457644","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF2ed73.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566093247004063
Encrypted:	false
SSDEEP:	768:mE43ncWPO8fk/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjSOmJrwppGtuL:mE43ncWPO8fk/u1jaK7m6mtw
MD5:	2F7BB4B345CA9D08F595F72BDD4F8726
SHA1:	7932E2982B0E0BAD38525A9CD07523A99B857399
SHA-256:	5E30E93086EA21DBD62826601DDA5A14247675E96F7545E58A8B2E2573A59CED
SHA-512:	A43D16C919AA16803D5139EB7DDF111F775F60BF755BCCA2CC6ECA39567D917E86869B8D1CA03082551D25B19C376CF34D711729FD17CA7EF07174D03881E9DE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369319394457644","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369319394457644","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.162999656657868
Encrypted:	false
SSDEEP:	6:NrNq1wkn23oH+TcwtSQM72KLlLlcYQyq2Pwkn23oH+TcwtSQMxIFUv:NrvfYeb0L1lnQyvYfYebrFUv
MD5:	E33B9D6401AAA0C4A5EE11DDB8098656
SHA1:	DE4EEE073E385E792560AAD946C106D6A59E5D45
SHA-256:	28526ABC4C26D2A7FA40411AA9E6F910868211D4940990D8381CED9E5B0D4DF1
SHA-512:	8F4734901E3FF93206E96E899A1AD4E36246D0B1AD02A394361C03115ECDB80608F1011199E647F308D9505D6DBF0C5E4D95BE7B7C1391F1770ACB8448EEAC2F
Malicious:	false
Preview:	2024/08/28-07:50:11.749 1f90 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/28-07:50:11.769 1f90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.119726858643055
Encrypted:	false
SSDEEP:	6:NGaGcXs1wkn23oH+TcwtgUh2gr52KLlLUF8pM+q2Pwkn23oH+TcwtgUh2ghZIFUv:NGaGmLfYeb3hHJL1O8i+vYfYeb3hHh2g
MD5:	5CD2F129FF2B8CAD6D886D68B562829B
SHA1:	E00ECB78C7B340FA811607D4D0EB67E4577095E5
SHA-256:	4EFFCF4F600CA9D78A3B874E13399B99505EA1BA934A34823EC00038D6966E8E
SHA-512:	2578F324E637A28213E0BBB9DDF500DC67D2AB8B4E6061561870D3A95DF92D92B0A747E9F80E72F40064FB609CB47F430F34B67B966E9A54C1B9D839C95797A7
Malicious:	false
Preview:	2024/08/28-07:49:54.438 1eac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/28-07:49:54.719 1eac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsule:Ls
MD5:	972BFA4E5F61233C634ABB85C6DE3A5A
SHA1:	EB9BA728F2295A148F0C4664C079D127A8E58A70
SHA-256:	11B3E846BCC955B5ACB2F7B114C1995B360FB4F9A02985C001ED60A757DF69A9
SHA-512:	6123990804BBA0C9E6AFB340A63D665B0C89182BB4D5FF73956B99C29DA9673E3775823604BBBF6FD819504BF1C7996865AD3722D6309D4E2E2B82C5577C3B30
Malicious:	false
Preview:	........................................N%.=S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:4mEjEGt+Kl:4mEwf+
MD5:	C7F3B29F34F5F86D93908F02148FB1C7
SHA1:	B337705FD30F36F9F6AC4BE1FBB9714B4B24D20C
SHA-256:	534448830C08583C67B672A910BAA36F86BD3E2AAB6F23AA11ED92075725BEE5
SHA-512:	1DD53951E5CB787C20BFC415779038975EEE84FBB99D26D0AC5CD7D82BD61A4766D6214F069CFF1D5C4FE808D6BAF52EB2FA1C80A95931B032DB10D7E8A2B688
Malicious:	false
Preview:	(...%cT.oy retne........................Z.s=S./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:4mEjEGt+Kl:4mEwf+
MD5:	C7F3B29F34F5F86D93908F02148FB1C7
SHA1:	B337705FD30F36F9F6AC4BE1FBB9714B4B24D20C
SHA-256:	534448830C08583C67B672A910BAA36F86BD3E2AAB6F23AA11ED92075725BEE5
SHA-512:	1DD53951E5CB787C20BFC415779038975EEE84FBB99D26D0AC5CD7D82BD61A4766D6214F069CFF1D5C4FE808D6BAF52EB2FA1C80A95931B032DB10D7E8A2B688
Malicious:	false
Preview:	(...%cT.oy retne........................Z.s=S./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:yzqEwsRY2Tn:yzFvY2T
MD5:	9412CA17925518A455C3F6561282F765
SHA1:	2DA4A94A219DD848E5BEFB14C4C65E1BF79EA510
SHA-256:	52C903712FA13F47C0CF9804A6B899AA4F9E67C3B0E96129021CF7F6EC91A969
SHA-512:	B117745ED7F8949ED0F07D05B1D26B67A3AD6BE54F4D8ADF2A3CFFF17A02221875CBC9B57A103F81C130EC41B1320C84E5459761110689888F3C174576D7D338
Malicious:	false
Preview:	(.....5xoy retne........................lIt=S./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:yzqEwsRY2Tn:yzFvY2T
MD5:	9412CA17925518A455C3F6561282F765
SHA1:	2DA4A94A219DD848E5BEFB14C4C65E1BF79EA510
SHA-256:	52C903712FA13F47C0CF9804A6B899AA4F9E67C3B0E96129021CF7F6EC91A969
SHA-512:	B117745ED7F8949ED0F07D05B1D26B67A3AD6BE54F4D8ADF2A3CFFF17A02221875CBC9B57A103F81C130EC41B1320C84E5459761110689888F3C174576D7D338
Malicious:	false
Preview:	(.....5xoy retne........................lIt=S./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlz:Ls3
MD5:	E917CB3F393201843AEE5D8A0213113D
SHA1:	C6C5C6A0AE4D9454D8B76BF89EF6C03B9056ACF6
SHA-256:	6A167952583C10ED37543CBE30EB109E53D90421F4234A15BABCB995A5AD89EB
SHA-512:	9DC20F5516006D1B8125E572F978ACE903B7E4A8E1CC2A003D64FBF3223743B8686660AC7CA7948D6E966C2EB17F2C9460E1C31EBCC3958556A2B0FDE57361DC
Malicious:	false
Preview:	.........................................{\|=S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl1o:Ls31
MD5:	535427695FF157EB2DFC264E355C8C31
SHA1:	1D9B6BF6F7BCF73E14DEA65D882C77F44DA436E6
SHA-256:	28891782CD7FF54E4894B56045C620EE91688942C10D04608ABBD3248961DA5B
SHA-512:	211878BC954F313CEBD1796DF3E4F1BE0BE8C9EE812FA7A42D62517297FC8EEB2D50E724487E632B586C32194DFD305B8561A25C07261019ED05F708E7D5BE1B
Malicious:	false
Preview:	..........................................{=S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.250566154747088
Encrypted:	false
SSDEEP:	6:N5DRq1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLlLtIQyq2Pwkn23oH+Tcwt0jqEKj3V:N5DbfYebqqBvFL1tIQyvYfYebqqBQFUv
MD5:	1DA1CAC543CC0F1753859633005C2E93
SHA1:	6E17D1032DE61DA47FED34EF31EB27388F886E50
SHA-256:	A6C5E73902FC233FB8757398C12ACE0D1D95C1A3A3237997983B8D10DBD6B0E4
SHA-512:	C803833A64E2ADDC165055964931A44CBE6063A72E8C8B06095E4E5DCE18891071FE10E74C73F0BAAA0FAEA2E55ECE7A8D9F386B7F5B23A73CF608206F3B9D3D
Malicious:	false
Preview:	2024/08/28-07:49:55.943 1f90 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/28-07:49:55.971 1f90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\42eb7873-cd69-467c-84ac-d9a39e71ba48.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\772460ad-3fbd-4705-ab1e-3b9d2ca0ff21.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8238ff91-af2e-4580-9013-ada370ab1a0a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3ad96.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c341b5ae-e91d-4c35-a793-9d79d9c5c35c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.21451062668769
Encrypted:	false
SSDEEP:	6:NJNq1wkn23oH+Tcwt0jqEKj0QM72KLlLE0anQyq2Pwkn23oH+Tcwt0jqEKj0QMxh:NBfYebqqB6L1inQyvYfYebqqBZFUv
MD5:	CDE0AC01355129367AE1CBAF1D5524EE
SHA1:	A2764D5A403A0868D30D42A25FCB87FADD0933B8
SHA-256:	B41E66BFCE010BA0B91EA6F244DA45752137BE9A3705621EF732D07D6EE2921A
SHA-512:	4A107EC17BB902BDBAE7843492D92E5E229E875A3528ABBB0D65E1EEA8F74EE83EC47BD1694DAC1709DF82A141E8562AE32498944DDB319716F99BCE98230312
Malicious:	false
Preview:	2024/08/28-07:50:11.686 1f90 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/28-07:50:11.719 1f90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.232471602293266
Encrypted:	false
SSDEEP:	6:NAd1wkn23oH+Tcwtkx2KLlL4aQL+q2Pwkn23oH+TcwtCIFUv:NvfYebkVL1HQ+vYfYebLFUv
MD5:	400161ED9F675593C829EF28EABD74F0
SHA1:	28BC27EB0B0AC07DA46892952FBD821F3890ACD3
SHA-256:	49AD7354B797223FF91523EC115D74F4F63F025951A4CD7E193397C54713E43B
SHA-512:	D4D0FB9F28DAE9280B9A3A71F710AFE8305D440B6E3AA3FA48445C4EB35C75EABC4054B0C1BFDD5373A9B601CD3B25A7F5528E6925C79C7FFD9375DBFF91B462
Malicious:	false
Preview:	2024/08/28-07:49:54.452 1eec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/28-07:49:54.676 1eec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVmFl/:IiVmFl
MD5:	A538F9E3D778BCF7014EB8BF3F4223F4
SHA1:	1BFD69FC4135E05AA0A1A3ED6876385D6965DE45
SHA-256:	91CAF1611DA3B7435C4165FCA86920C0092CD812B93A6364EE1182988D842C91
SHA-512:	ED5C163ADD2C1F196023C55F2A7A3C618CEC2C46CD4ED1D61D03AA4B88428D9A7EFF2EF50616B1CEE01002747479BD644002754D32903690054F21C52911C2F8
Malicious:	false
Preview:	VLnk.....?........Hpt.Q.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0765504878661527
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkO3SAE+WslKOMq+vVumYIZn66:e/2qOB1nxCkO3SAELyKOMq+vVumNp
MD5:	4A1C3ECF6156F30468AD8AF35B5C6089
SHA1:	C0734F074E2C9FF4DDF3134F1AD5BC9D6EDD26F2
SHA-256:	4F916FA237FC311E7E396A8E4168BA9EE65E076B398CEFA51F84099DB08DE596
SHA-512:	B15933A6F19A32EA2B8E090B949A0B569EF5658BB7F6BB8C76BE2F6F0585A6309C53B4DC6F0B52871AD5F3ED8B4D4C584081408D989F8FD1B5F35F407E27A7F7
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\e11152df-3ec1-4687-85d3-e455489cd6ec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.975637440342471
Encrypted:	false
SSDEEP:	96:st+qfRis1rb9/+xBN8zjs85eh6Cb7/x+6MhmuecmAeAqXu2MM/EJ:st+XsaxBNkjs88bV+FiAC+PMMJ
MD5:	A402AE345AA5D57E233E53A02158EEB4
SHA1:	16D46610EBF6A0F2CC8F4DA95BB6053A35E2A252
SHA-256:	198A514921A6DFFDFB46741E9722E6E2F5CD5EA097AAC0CC7E8465A38F4BE0AF
SHA-512:	8F20A6AE51DE7506A35C3529BE930C927D14B86530BC1AE568B0FB8F45AEC68926A216CE54A4FED29B6F4AE6F46B1A98E98286068342D744CEFFCA1CFF80D33E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369319394975826","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369319394982852"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ff1d8a7e-771f-442d-8366-b9ea121704f8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.565880908842144
Encrypted:	false
SSDEEP:	768:mE43ncWPO8fb/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjSOmJrw5pGtus:mE43ncWPO8fb/u1jaK7m62t7
MD5:	2D8B24458826AF87F6D277EBCE4BE3C9
SHA1:	97F07E90CE43A4F42BD697D1EF04F77025046E98
SHA-256:	93EB803F13A36A976DE5BA64256F54781D709D87406642F7AD4A9350AA8A8E27
SHA-512:	240440C5EBA332F17D69A94F39A34D5D0B2D9C298BB6570EE128728E96742399CC0EA3BCBE012431A6702478B814C2C8E9F256C39FEFCEDE6C317D1F7815FF9F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369319394457644","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369319394457644","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/Iu/FlFll:7+/l/l/
MD5:	65B9055C7E36BECB3B8C69B17B305493
SHA1:	0BB2542D680D6C501868BA1185BA8A5D271D608C
SHA-256:	B1964538B853538FDB4C940B1F171662BEBE0018892B14FE9799EE7620622FA7
SHA-512:	8EACD426E6240481B850E7AD934A9BE039018C95BD5184F5B7E1A93F9EBE581D2B0382668FBE150C82D4B6D0D159309CB3151925C8947647BEE2A19C03B82D5E
Malicious:	false
Preview:	.... .c.......t.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.049769724808172676
Encrypted:	false
SSDEEP:	6:GLW0WP0iRW0WP0cL9X8hslotGLNl0ml/XoQDeX:awfZwxGEjVl/XoQ
MD5:	694F4DABA87FA2C89E99FAC01B610309
SHA1:	50A385F13505F5DBF212A05B2E2F2095FAEEB5FC
SHA-256:	F0D54DDACC0594DED7CF2792DB62ECADD070129786E6450208F1D4FDFD2F03DD
SHA-512:	C56EDE457384BBB68159526F54ED65A5F5E5890E1F2B2CC75D99794CEAF9C7C6DF63887E5FE3DA11B2A07DB7D258AC3E50DF0AAF744DD8B387E0E6A616F7EC05
Malicious:	false
Preview:	..-............................'..O..a..6.3w...-............................'..O..a..6.3w.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9965214290145195
Encrypted:	false
SSDEEP:	48:ulzxL4lO+wcbX+rn9VAKAFXX+l2VAKAFXX+p+xOqVAKAFXX+8nUYVAKAFXX+3ec:AxLcaANsjNspMO5NsXNs3x
MD5:	BEBFFFFC358A6E6B5D29BF5543F0DD73
SHA1:	9559471AAA3F30745FFADF8A87B2A81D3B221904
SHA-256:	EFB7DF49DE43746A10A01D907BA376F01CCC2CEE7F4AB1673705961D6AD05876
SHA-512:	4F7BE3FE618E12D76D64406CE3BCFAC03D41A99F6207BF12874705E0E7B0849C73FE2ACA549982E7E96BB068DB8CF29DF82B87C21CF0B252E1F440C2708BBB70
Malicious:	false
Preview:	7....-...........'..O..al.+..D...........'..O..a..a4\.`.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.488845503684413
Encrypted:	false
SSDEEP:	48:kD87SBS2QrPyHRHAx2IYjIYczMqktMYjMY5yjAlkfAlkh3:202QuIYjIYczMbtMYjMYYYcYM3
MD5:	1B89BC85D0792414059E1C98D960CE73
SHA1:	60A3A174341C74D5AB840B94B34120767E7CA449
SHA-256:	50ABA89C195C08E6F0E5FDF12727FE6F611BFC9526313E411B9CF49BE2D6A4E7
SHA-512:	21E9ED13FCC8A6270085EDCF933D69636CE6BF9BC0D1F49227F2DD51EE368F6266E5AA4C248B1E93AFAD59256886F3F08B0F15E624708D97431033EF1F240942
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1.J.=0................39_config..........6.....n ...1u}.=.................AI.................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.2243010350876515
Encrypted:	false
SSDEEP:	6:NyaT81wkn23oH+Tcwt0rl2KLlL3q2Pwkn23oH+Tcwt0rK+IFUv:NbbfYebeL13vYfYeb13FUv
MD5:	C544AFF4733D4FDE6D4A07F15FA7E3F8
SHA1:	2C605E10F6F8B19E2DA0569398F7F795F7BB5EFE
SHA-256:	C493E0934EB6EAF95229E950F412D6412451181178A1F0128CB7C7C4D3E149F0
SHA-512:	B409FE3A16B718185B2BC11FFBF16CEACC1DB80B463061F9DE34A4A4C4DB2274AFA98EBAA94B606AB20BA3B1878B8A85222260B36DED59EDF5B37540C3CE0238
Malicious:	false
Preview:	2024/08/28-07:49:55.001 1ee0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/28-07:49:55.014 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.9474235088980287
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01z9Bge6Nqa:G0nYUtypD3RUovhC+lvBOz8
MD5:	A9E525858391955E377EF1FD6E0C73A1
SHA1:	711F920CC2ECF7A953F4181054B6029E73466654
SHA-256:	4A4763A9FA535D331A1CACC2D412054858B65D5B7710CB5AB2141DA93CDDF703
SHA-512:	D6FDDD41ACD7D4C5450BCD05B0E121CF3DA520EB684B0858F58CEFFE55AECE2A6DDD6DF8718C455674799AB9FABD098817F7C2B794490D3C920A21569E736665
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.......=6.................3_......\|...................4_......M...................3_......-D..................4_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.213712630159007
Encrypted:	false
SSDEEP:	6:NaRFZT81wkn23oH+Tcwt0rzs52KLlLaOAq2Pwkn23oH+Tcwt0rzAdIFUv:NalbfYeb99L1aOAvYfYebyFUv
MD5:	803CC195895324A336F83824BD304887
SHA1:	60D1716391FB47067B8B8175C6BA4F736C8F7B6E
SHA-256:	310ED2B5520C3B416D97FAD606D87A05553C2B22B4CB79E72D236B191B986C5C
SHA-512:	4DB157E78610CC669F4C097F19E94C3C8ED526036C920C0561610C0AC99D50D2718329F432D10900AAF6CB9BC9D398A7EA91AF9F046E6E414D2177195F377C86
Malicious:	false
Preview:	2024/08/28-07:49:54.986 1ee0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/28-07:49:54.999 1ee0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlFR2a:Ls3d
MD5:	20E27660703C99409D9E78E84F90B752
SHA1:	F29003EF77F1708246B1FB2B5E3A62E1494DC275
SHA-256:	5C6740D1925C517A575C3DB8729939277B41D27538DC2BC206CDDF5994B90B37
SHA-512:	7361C77C43D38282E4D056E61EEDA2E77CC04D7E59E9012CFB8ED1F483F80853CAD69120EA6C0A91B74FF798B8DA0EC565084BAC509050F7DBED7624DB824C65
Malicious:	false
Preview:	..........................................=S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNli1/:Ls3i1
MD5:	6B020DD3017A93B967827FC196C56CA2
SHA1:	64BEC116C8BEE3E534EBBC1CF59AD2EF3F6FFD49
SHA-256:	D2A709836147CC40669B8E50C4F8A44AD286B5E1DA90A31FECD27D3EA5C6C640
SHA-512:	00FD3E86D0A8F4B51E49DBEB02CBCFF2C4A617F9B155816F7CF5C3FFDC12CAD819C3E07D780BAD96BFD8242774ECE59BF80B726B91769FB19C63D5D0E6160DD1
Malicious:	false
Preview:	........................................D*.=S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.552339259592703
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtKGjnxabhskLVkFO+phtiyikiuoJdXBuBuwBiaAK0FKNh7TX6/:YuBqDPafHnM2kLVko+jt4vgBzBij1K7W
MD5:	D93169BDD755817D9D8E7D46779D1137
SHA1:	E53C754AACD56522C6BF686E1D2CD9425C4AA83E
SHA-256:	026B328E30FB24660CDD35A637721ABDEBB7F41B0A54C0F515CD9AB1ADCCFB7F
SHA-512:	69EFEFB6DFA3484D487F65658159582A728301C29D9E3FB736FF1404B8B64E2F5817EFA404309D36F77C29BF1C5CF511D3EB50AD17A40697D95D925854F68225
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369319393933435","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724845793"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF281c8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.552339259592703
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtKGjnxabhskLVkFO+phtiyikiuoJdXBuBuwBiaAK0FKNh7TX6/:YuBqDPafHnM2kLVko+jt4vgBzBij1K7W
MD5:	D93169BDD755817D9D8E7D46779D1137
SHA1:	E53C754AACD56522C6BF686E1D2CD9425C4AA83E
SHA-256:	026B328E30FB24660CDD35A637721ABDEBB7F41B0A54C0F515CD9AB1ADCCFB7F
SHA-512:	69EFEFB6DFA3484D487F65658159582A728301C29D9E3FB736FF1404B8B64E2F5817EFA404309D36F77C29BF1C5CF511D3EB50AD17A40697D95D925854F68225
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369319393933435","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724845793"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF281d8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.552339259592703
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtKGjnxabhskLVkFO+phtiyikiuoJdXBuBuwBiaAK0FKNh7TX6/:YuBqDPafHnM2kLVko+jt4vgBzBij1K7W
MD5:	D93169BDD755817D9D8E7D46779D1137
SHA1:	E53C754AACD56522C6BF686E1D2CD9425C4AA83E
SHA-256:	026B328E30FB24660CDD35A637721ABDEBB7F41B0A54C0F515CD9AB1ADCCFB7F
SHA-512:	69EFEFB6DFA3484D487F65658159582A728301C29D9E3FB736FF1404B8B64E2F5817EFA404309D36F77C29BF1C5CF511D3EB50AD17A40697D95D925854F68225
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369319393933435","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724845793"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2836e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.552339259592703
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtKGjnxabhskLVkFO+phtiyikiuoJdXBuBuwBiaAK0FKNh7TX6/:YuBqDPafHnM2kLVko+jt4vgBzBij1K7W
MD5:	D93169BDD755817D9D8E7D46779D1137
SHA1:	E53C754AACD56522C6BF686E1D2CD9425C4AA83E
SHA-256:	026B328E30FB24660CDD35A637721ABDEBB7F41B0A54C0F515CD9AB1ADCCFB7F
SHA-512:	69EFEFB6DFA3484D487F65658159582A728301C29D9E3FB736FF1404B8B64E2F5817EFA404309D36F77C29BF1C5CF511D3EB50AD17A40697D95D925854F68225
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369319393933435","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724845793"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF283bc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.552339259592703
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtKGjnxabhskLVkFO+phtiyikiuoJdXBuBuwBiaAK0FKNh7TX6/:YuBqDPafHnM2kLVko+jt4vgBzBij1K7W
MD5:	D93169BDD755817D9D8E7D46779D1137
SHA1:	E53C754AACD56522C6BF686E1D2CD9425C4AA83E
SHA-256:	026B328E30FB24660CDD35A637721ABDEBB7F41B0A54C0F515CD9AB1ADCCFB7F
SHA-512:	69EFEFB6DFA3484D487F65658159582A728301C29D9E3FB736FF1404B8B64E2F5817EFA404309D36F77C29BF1C5CF511D3EB50AD17A40697D95D925854F68225
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369319393933435","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724845793"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2aacc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.552339259592703
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtKGjnxabhskLVkFO+phtiyikiuoJdXBuBuwBiaAK0FKNh7TX6/:YuBqDPafHnM2kLVko+jt4vgBzBij1K7W
MD5:	D93169BDD755817D9D8E7D46779D1137
SHA1:	E53C754AACD56522C6BF686E1D2CD9425C4AA83E
SHA-256:	026B328E30FB24660CDD35A637721ABDEBB7F41B0A54C0F515CD9AB1ADCCFB7F
SHA-512:	69EFEFB6DFA3484D487F65658159582A728301C29D9E3FB736FF1404B8B64E2F5817EFA404309D36F77C29BF1C5CF511D3EB50AD17A40697D95D925854F68225
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369319393933435","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724845793"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2e65e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.552339259592703
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtKGjnxabhskLVkFO+phtiyikiuoJdXBuBuwBiaAK0FKNh7TX6/:YuBqDPafHnM2kLVko+jt4vgBzBij1K7W
MD5:	D93169BDD755817D9D8E7D46779D1137
SHA1:	E53C754AACD56522C6BF686E1D2CD9425C4AA83E
SHA-256:	026B328E30FB24660CDD35A637721ABDEBB7F41B0A54C0F515CD9AB1ADCCFB7F
SHA-512:	69EFEFB6DFA3484D487F65658159582A728301C29D9E3FB736FF1404B8B64E2F5817EFA404309D36F77C29BF1C5CF511D3EB50AD17A40697D95D925854F68225
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369319393933435","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724845793"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF33a89.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.552339259592703
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtKGjnxabhskLVkFO+phtiyikiuoJdXBuBuwBiaAK0FKNh7TX6/:YuBqDPafHnM2kLVko+jt4vgBzBij1K7W
MD5:	D93169BDD755817D9D8E7D46779D1137
SHA1:	E53C754AACD56522C6BF686E1D2CD9425C4AA83E
SHA-256:	026B328E30FB24660CDD35A637721ABDEBB7F41B0A54C0F515CD9AB1ADCCFB7F
SHA-512:	69EFEFB6DFA3484D487F65658159582A728301C29D9E3FB736FF1404B8B64E2F5817EFA404309D36F77C29BF1C5CF511D3EB50AD17A40697D95D925854F68225
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369319393933435","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724845793"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF36d61.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.552339259592703
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtKGjnxabhskLVkFO+phtiyikiuoJdXBuBuwBiaAK0FKNh7TX6/:YuBqDPafHnM2kLVko+jt4vgBzBij1K7W
MD5:	D93169BDD755817D9D8E7D46779D1137
SHA1:	E53C754AACD56522C6BF686E1D2CD9425C4AA83E
SHA-256:	026B328E30FB24660CDD35A637721ABDEBB7F41B0A54C0F515CD9AB1ADCCFB7F
SHA-512:	69EFEFB6DFA3484D487F65658159582A728301C29D9E3FB736FF1404B8B64E2F5817EFA404309D36F77C29BF1C5CF511D3EB50AD17A40697D95D925854F68225
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369319393933435","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724845793"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF39481.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.552339259592703
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtKGjnxabhskLVkFO+phtiyikiuoJdXBuBuwBiaAK0FKNh7TX6/:YuBqDPafHnM2kLVko+jt4vgBzBij1K7W
MD5:	D93169BDD755817D9D8E7D46779D1137
SHA1:	E53C754AACD56522C6BF686E1D2CD9425C4AA83E
SHA-256:	026B328E30FB24660CDD35A637721ABDEBB7F41B0A54C0F515CD9AB1ADCCFB7F
SHA-512:	69EFEFB6DFA3484D487F65658159582A728301C29D9E3FB736FF1404B8B64E2F5817EFA404309D36F77C29BF1C5CF511D3EB50AD17A40697D95D925854F68225
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369319393933435","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724845793"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3f2be.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.552339259592703
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtKGjnxabhskLVkFO+phtiyikiuoJdXBuBuwBiaAK0FKNh7TX6/:YuBqDPafHnM2kLVko+jt4vgBzBij1K7W
MD5:	D93169BDD755817D9D8E7D46779D1137
SHA1:	E53C754AACD56522C6BF686E1D2CD9425C4AA83E
SHA-256:	026B328E30FB24660CDD35A637721ABDEBB7F41B0A54C0F515CD9AB1ADCCFB7F
SHA-512:	69EFEFB6DFA3484D487F65658159582A728301C29D9E3FB736FF1404B8B64E2F5817EFA404309D36F77C29BF1C5CF511D3EB50AD17A40697D95D925854F68225
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369319393933435","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724845793"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNluBl:Ls3u
MD5:	58962419342C2254D43E89F02E1B5F9B
SHA1:	EEED487B85A621F32D76D7AB3896E966416112DB
SHA-256:	58E95026A6E23583F5F2C0D4DB17007B01E14AD29674277A4396783B4C7CEA2D
SHA-512:	B280E28D09BA88975B23D79C3079B7F5D124FF2EDA169618444F237DB9F7EC4DA774CD2A8C6320CE2EDA66892ACB51A7C1E2AC43F1A9735A798425A704561623
Malicious:	false
Preview:	..........................................^=S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\bdd1fc7b-550d-4865-ba6c-37aff07abeda.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20983
Entropy (8bit):	6.064799055139126
Encrypted:	false
SSDEEP:	384:utM7XKnG7EtlXrjYJUoLUJqHsdZsJHaV8NBSUaaSoT8DguUK7qkR7FvA4fiBVSWf:iM7X2zt1jKYqHkZeM0SoQDguUKugvFaz
MD5:	CA5A0A04CFB16455B308B91CC90A6727
SHA1:	0C031E2FCB15B522729AE3340BC8AE4F953DB817
SHA-256:	07A67E80410617A28768AC11433F19503D6E20718D9A23212A182254BA9353A0
SHA-512:	95628FAEA3D4CCE2A66A8BE488D8C6CA564782ADF95164B9B424005C5789D62162A23CAB7DF9754C162B8219A760F2A1C46FAC052518399CB4C4D29CCE8825CE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369319395187354","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\e19d1d95-db7a-437b-ba2b-bc6989dc7e39.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71481
Entropy (8bit):	6.072571337630322
Encrypted:	false
SSDEEP:	1536:iMSzvKYqstmiAoc1EKuhJM9t9ztCfUuu8EI0B9wgpfg1DJG7GmmTtzXFKj0z:iMS2dKHdKUMJRu+dBiga1DJKGmQtzXFJ
MD5:	3683F7C1A11141DC42D37D36F0119D78
SHA1:	EB84F4C19E99581F3F3708D7F9DCD9A6EEA29CB8
SHA-256:	91FCB0A6D79911438A030D173958567C93DB9D039B9E98A2A26004E2465F1552
SHA-512:	FE0887842D40FB9F2A318E0688C67151A2FBC7B1FB13A503281D3B4BE39DE736F5BC2756614F244F3BCFE3D4DDCCA6C78D15157250E4F4D0B111B127C80FBBB2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369319395187354","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\f3b83752-38ca-40ff-a25e-577843b1d624.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.592564568329289
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afHnM2kLVko+jtSvkHB+udrxEdVvBij1ZnRf5aJkXacK+wlR6:Xq8NkC1fHMpLVkomSGBPWdVvop/fkJkH
MD5:	AD2B68C0E28F82333A27804AFE707D2F
SHA1:	129AAC6CA35507CDFBE0504B80764DFC28B483F0
SHA-256:	D0F1493598108AF259CC1A0D53660F4974D9F196B6D7A5D79B039E97ECC45075
SHA-512:	1FB656250D93053CE09A5107F05E4E0814EAA399EA97A1BC880EE2F55DAE39A0DFB43BBA7406C4269C523CC8ABFEBD0365738742F19A4BC897D44BB005D38A2B
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC3y6LGgRk1xv7/qWPlpqlLElO+C3qAS+/tu+L8Y8fmkgAAAAAOgAAAAAIAACAAAABW+iPv9PmWLoL80W1UlDUKy+/9s5g0MtdijWzGyk0rxjAAAAB7DlJOTMGjd4BVaGa9HYJvX1wrSQ4vE70Uc76v33piO8tPu0FYBFWYidUpaC3WsUdAAAAANFQAORiOyrJoOnb6/RlVi8QOGhJX2HK2fUfBwp/oZos515p8lvZVpj89MGMKv/qKaJhjJKmnhiBzFEk3cFFDxg=="},"policy":{"last_statistics_update":"13369319393986119"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\07b0d9a2-ac5e-422d-852d-08b0204c230c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59843
Entropy (8bit):	6.080575627880096
Encrypted:	false
SSDEEP:	1536:MMSzvKYqsteAnaf8dP0SIedWZn2aDcU0GGizp3:MMS2dKOkdP0SvWZnPohGGizp3
MD5:	8F51945CB6E1F89CB7E6AA4E5584AAC2
SHA1:	199CDB98B2C888367D6464C147F1BD7138BD9F39
SHA-256:	D9A4835D6421AD3A81B764F120507081D7C79FB03C057E1665253D5CE9A328D9
SHA-512:	00A3621ED2FC97DCA2D52E5BB064CABD8E60E5A2A2783E06DC3FF42D6CF1650FC53E02F14A545AFB375BD5F10FDCB587D900178B37A9360E434A6477F2634C0D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369319410354439","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1ac1e32b-86f2-4a14-931d-7f11991ba1fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.058120753814106
Encrypted:	false
SSDEEP:	384:MtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaVsNwFOz60KB00jGX4KXs:MM7X2zt1jKYqHkZeMh060KB034Kc
MD5:	5C47FB99EF40DD115115FB18BEE72C14
SHA1:	2BF891541DBF0B21C1EE6419E741EF4F0CB0F194
SHA-256:	191B41D4EE034B9C2DE217604323A6603B32C94FF3E256BFCCDADD5CCD310282
SHA-512:	102A53B2FBB1B62A2A14BB47B2A0A4D10F8D6556A5B1C77B1089AA1737CE70A5FD7277478293256898DCFE175357FA72C7CB36D96A382C906640EECD05BFB94F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369319410354439","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1bd3a4ad-6822-4738-bc0b-3ca7a010f9a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9448
Entropy (8bit):	5.835309472184099
Encrypted:	false
SSDEEP:	192:fsNwPaeiRUbI1vQ5ayOkKH96qRAq1k8SPxVLZ7VTiB:fsNw4SwY5hdKH96q3QxVNZTiB
MD5:	6C6BAA39FA77D63E0091577F8B9CDE4D
SHA1:	D6A13B821C7ED57080EEB430C3752AB7EBFA15E5
SHA-256:	BFEBBB1C8E3C4BE70BFB8468FA30F832A1605677728EA7AE04BD883FD935E473
SHA-512:	C632166EF938CB7DBE05CB85D386D41656D12D4F32C091CC71B1BC57FA6B47FA047ED1139071213AC16A33E34ED08EAA7FF2F19D2CAB49F2E1F71E017B2F6E39
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1fe2c7dd-481f-488f-a73b-6479f03cef15.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793081437040778
Encrypted:	false
SSDEEP:	96:iaqkHfHmb5ih/cI9URLl8RotonMFVvlwhWe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akP7eiRUEh26qRAq1k8SPxVLZ7VTiq
MD5:	D38AAB5B978BBBED027256487EF9BF2C
SHA1:	43DD71C36669BD8C05BADB69735ED7467BA4536F
SHA-256:	66B12BA154FEBFA0A54966EE7216E095CB0A3EEB0DE615D8D2447FAE00FA5F20
SHA-512:	8E1087914A2B2F428CB083803585AD908565CF529200006B66BCE5F8E0D21508C0E5C71636F76281EA5672E4AD1D1A59E6D40273FD2C36CC8C23F0654733CAB4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADtRbm4kf504FQIjz5dsvPhbQnP4EfnJFN63zrs2/urLAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2431b17c-e01e-4336-ab2f-5edd8e383cb2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9448
Entropy (8bit):	5.835403821695034
Encrypted:	false
SSDEEP:	192:fsNwPaeiRUbI1vQ55jykKH96qRAq1k8SPxVLZ7VTiB:fsNw4SwY5NxKH96q3QxVNZTiB
MD5:	51D4C8E1586E16B81CA9B2FBBFC4E0A0
SHA1:	86537DEBD2C3021169963FD877AF46B76353E3FC
SHA-256:	5EC7401AF551E343DA74FAF1E70E3F1DC370716B25545C93DBB3A6167FECA42D
SHA-512:	EC34CC086A4AAA765DDE534A6F11068A304F9E528C4ECC23BC22D854C007C48388A768BC66FA72349A344B073B7D02FEE44B1635B73BC23376FE48D1A56E58B2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\45df6684-a31f-4057-9c52-e12fb0a37c50.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.798793767463661
Encrypted:	false
SSDEEP:	192:fsNwPaeiRUbOQpkKP6qRAq1k8SPxVLZ7VTiB:fsNw4SP6KP6q3QxVNZTiB
MD5:	26B677DBC9B779370BB7DE981E009B89
SHA1:	028D7620B244C70A321F6B8B71A09D3BAF51CD10
SHA-256:	716943AEDD5A7947C3F1808E32BD4214431A1887CEAFCCCD6609D72F5EC48DC8
SHA-512:	DA5AD0F5A7AB3D1B668D471418E6D6CD00DD67B7DE408A9E0576AC276C75FC6178A91D2E6F0DB55F5DC40ABF6A43317B98C80D604A7D594D107A1EB1FA9DA8E1
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\471f50ad-a5e8-4ecb-acd8-2fb196c9176c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9448
Entropy (8bit):	5.835309472184099
Encrypted:	false
SSDEEP:	192:fsNwPaeiRUbI1vQ5ayOkKH96qRAq1k8SPxVLZ7VTiB:fsNw4SwY5hdKH96q3QxVNZTiB
MD5:	6C6BAA39FA77D63E0091577F8B9CDE4D
SHA1:	D6A13B821C7ED57080EEB430C3752AB7EBFA15E5
SHA-256:	BFEBBB1C8E3C4BE70BFB8468FA30F832A1605677728EA7AE04BD883FD935E473
SHA-512:	C632166EF938CB7DBE05CB85D386D41656D12D4F32C091CC71B1BC57FA6B47FA047ED1139071213AC16A33E34ED08EAA7FF2F19D2CAB49F2E1F71E017B2F6E39
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5638ea51-91ea-428f-b7de-7bbfcfef56b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9448
Entropy (8bit):	5.835389884689632
Encrypted:	false
SSDEEP:	192:fsNwPaeiRUbI1vQ5r1vkKH96qRAq1k8SPxVLZ7VTiB:fsNw4SwY5JMKH96q3QxVNZTiB
MD5:	BDEC4AAA1C8C8B7E9FB96CA749D92426
SHA1:	B5DDD65F02C056BCCD3A9DAFDFB76FF9B9AB3B71
SHA-256:	028F5B71A6DB154A736CD4BD62444FFC6B22ECE48D42AB9AE2BA04900E1E647D
SHA-512:	829DF7553AFA00CEA0CC290448E6D5439A3BEE9A9EF651B0F26573CB480DA64501427FDFCC99E39C6133840B93CF614B751180A43D41B4560388A5E7208E6C3C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\776d13e3-667f-451d-9496-fc8cf215a0b0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	59882
Entropy (8bit):	6.080557070655076
Encrypted:	false
SSDEEP:	1536:MMSzvKYqstNAnaf8dP0SIedWZn2aDcU0GGizp3:MMS2dKJkdP0SvWZnPohGGizp3
MD5:	94AFA45BBC443623FCD9CCB55C6BD33D
SHA1:	C0AB5CC4A9CDA2DD5D729012977926B83E0DB9CB
SHA-256:	509DE2308290036371277EBF317395E3B36764CCBACA910858DCB77CC769A008
SHA-512:	7EFEB8B18FBE6322B6FDA444E6B68135E3AF33FCD2C3471CA2BC7D94421367B18E03DC3346A681E6DB57EF19DD982DC5AD391471E9BBE79FBFB36DB20D328900
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369319410354439","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8e8bb57c-ba26-42a6-9b28-ce01791d8d47.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9448
Entropy (8bit):	5.835403821695034
Encrypted:	false
SSDEEP:	192:fsNwPaeiRUbI1vQ55jykKH96qRAq1k8SPxVLZ7VTiB:fsNw4SwY5NxKH96q3QxVNZTiB
MD5:	51D4C8E1586E16B81CA9B2FBBFC4E0A0
SHA1:	86537DEBD2C3021169963FD877AF46B76353E3FC
SHA-256:	5EC7401AF551E343DA74FAF1E70E3F1DC370716B25545C93DBB3A6167FECA42D
SHA-512:	EC34CC086A4AAA765DDE534A6F11068A304F9E528C4ECC23BC22D854C007C48388A768BC66FA72349A344B073B7D02FEE44B1635B73BC23376FE48D1A56E58B2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\9920a2c7-7307-4bb3-8d16-1a97f3045487.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640169812365318
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7g:fwUQC5VwBIiElEd2K57P7g
MD5:	D317A1069717AF45FC861714DD0A22C5
SHA1:	35541055A1413A913A3367FBEC466E4B7ABC21A6
SHA-256:	5575BEA8664FF1D946BDF20A229510DB85D24B8722CBFBD0DC77583D93900EF3
SHA-512:	ABDDB701867F9D4322511ED7E2DC8EF0596C11CE6573F0CF1469C527B27CD13BADCA877E53050200FFAF4CC0269CDAA1AF4B885A1BE30364C44026DBD89667F3
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640169812365318
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7g:fwUQC5VwBIiElEd2K57P7g
MD5:	D317A1069717AF45FC861714DD0A22C5
SHA1:	35541055A1413A913A3367FBEC466E4B7ABC21A6
SHA-256:	5575BEA8664FF1D946BDF20A229510DB85D24B8722CBFBD0DC77583D93900EF3
SHA-512:	ABDDB701867F9D4322511ED7E2DC8EF0596C11CE6573F0CF1469C527B27CD13BADCA877E53050200FFAF4CC0269CDAA1AF4B885A1BE30364C44026DBD89667F3
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CF0EF1-23FC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3119488952253487
Encrypted:	false
SSDEEP:	3072:Se60w+8aKRpcJDtouDcVZlGHMTW9akl9OHDWnuxnHME0Siw+GEDq0Yedyftc7oA6:tiUoDWam9OZ29oAAaHISA
MD5:	4B6CB3B955044B7D12403F9AE64BD2AD
SHA1:	6B1D78427C8500175F5154ED25231872463BF91C
SHA-256:	02FCA14453A7C7FA8A87392E47AE69EE74EE004E272F2570D6F52CD589BE7445
SHA-512:	185B554B984236E436CF5732F40C4D5FED65A95F38E2CF2B6B8913FB8921870139A4E5F5057F2A09CC8870E2F6A20A8358F08548266EA070615E040A9A3F2C2E
Malicious:	false
Preview:	...@..@...@.....C.].....@...............`K...J..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".yxrbec20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CF0EFA-26E0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.039755967977855855
Encrypted:	false
SSDEEP:	192:XF0EbtmqvDtKX7zJEa3XxxTVwg7X3iV0DA5DhAVNTU+O1gQtHmDMq01n8y08TcmQ:10EtYeQt6nhU1agUmwX108T2RGOD
MD5:	4C5A05A23628923C6F8EA326270D1E90
SHA1:	D40D2D55D9C09E11C787448AFFE2C6E6C9B9DA85
SHA-256:	377626B283CCB0700F38E5BC74A6CA7E864F8D5D1F93BD4E39184FC376C2B874
SHA-512:	677679A561204B13B11E15717288EB71C7FA45A7E1DF0CEE89597C84747FED2D93761A00EA2FA66E1C9EB57F244DD0809E9CE2D4C3E5E958CB994B498BA65ADA
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".yxrbec20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CF0F02-2194.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03885894595157213
Encrypted:	false
SSDEEP:	192:T50EbtmqvD3KX7ezJEa3Xxx7UpXxgg6zfhj1NEx4nu1gQMZ0dZD3q2n8y08Tcm2D:t0EtdzeZVQh5d6gidxh08T2RGOD
MD5:	1D25D903B05D1334291AA4BA964FD07D
SHA1:	FE5EF1D77362B0AD77886DA36F22DB4A12F174AC
SHA-256:	3A474CDBD55E6749B7D8A4201D83BDEA79F9939E0E37D76E06E36F8E10364124
SHA-512:	69CBDBF08758B6BA81411191930E016DF7563975BFE2BB4E48FADE50273969C1834C667A79DCF4D6B405E584D0274608D7C55417CA118213AA6DBDB510217589
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".yxrbec20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CF0F0F-20A8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03887535689742391
Encrypted:	false
SSDEEP:	192:TI0EbtmqvD3KX7SJEa3Xxx7UpXxgg6zfhj1NEO+71gQMJcvlqmq2n8y08Tcm2RGY:c0EtHeZVQh5AhgFcLh08T2RGOD
MD5:	E569F4625B4CDB05C4AE3183C07BA4C6
SHA1:	36E6B9EA355A6FC0B47C358030D8CF38FAA38C0F
SHA-256:	6325814F8C81966C36ECADED85D5ADC1112B94A9EB5EC9EE22746F3B94BCE43B
SHA-512:	1D8254C96D2F2EE2B8A56A21C63ED83865C88C13A1B110655683961387AB1A91EF6FBB619D5C79DD56979AA6BC53B94E4292D92F7E663BF52FF9BCC580D84B0B
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".yxrbec20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\021aaab6-3176-4e98-8c2d-91f56f19d996.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.06474551203299
Encrypted:	false
SSDEEP:	96:sVvYqlWJ1orb9CP+9mqXzYAMsY5Th6Cp9/x+6M8muecmAeC/e4zvrM2X6gE5AtE7:sVwJJRG9mqjYAMsYPpj+FVAbMFBf
MD5:	EDD08D0D8E6C57C12486D388E2083A99
SHA1:	8E0B18CBF1B124802F73B91BE784163EBD460980
SHA-256:	15699BE24C7549FFD64CDA0672874A941CF3A799726A204A0D231A210DE650AD
SHA-512:	4B3696CEF8AC670F595E6672CE8897CCE985FE40322FF7BDF89F26592FFE7449E292EF97CC8287664C4963EF4A6E50BE0BBBA08CCAA5603C95CBB2A1DD892C43
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369319410410021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1333b106-5c22-46a6-8b87-9e3ea5120911.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\174e8575-e89e-44e7-be01-bb209a71d213.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\17607171-c691-4173-a169-e1232ece4abd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9297
Entropy (8bit):	5.18060474390031
Encrypted:	false
SSDEEP:	96:sVvYqlWJ1orb9CP+9mqXdIiE3FYAMsY5Th6Cp9/x+6M8muecmAeCiee4zvrM2X6p:sVwJJRG9mqWiE1YAMsYPpj+FVAJMFBf
MD5:	F3F4A76FFED0245895B92548B49B0DAF
SHA1:	2A44E529DC54600D7A9F82DFD5868FA6F6818F5C
SHA-256:	5EBA617526574B2A5B4BA5E561649DF37A8B72CDB71F36B89E355664824C50C0
SHA-512:	58FF8E78D23C70DD56D479F0EE21E3CD03EC04AF9E285285A66941ACF6729B71A1CD9E8A2137BA5FD0E85629FDDC99D176A594C1C06D5ECA5EE0DE163C8B1344
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369319410410021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\18636614-4deb-4704-8402-d601df650937.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9335
Entropy (8bit):	5.179319707916992
Encrypted:	false
SSDEEP:	96:sVvYqlWJ1orb9CP+9mqXdIiE3FYAMsY5Th6Cp9/x+6M8muecmAeCMee4zvrM2X6p:sVwJJRG9mqWiE1YAMsYPpj+FVAbMFBf
MD5:	B424181B8A3C7F71CF5F782C6249792C
SHA1:	6329E000330A8F922149E0F20F0F1A8AF9DC4470
SHA-256:	74BA3E4793C7385C1BF81EBACC1945FCF7B44015D8565C43A639F7535A6C1CD5
SHA-512:	6405ECD7C2C4B68A9355F2D693A1A02B9B76ACC4C2D140FC60E3C7B0B8B22D6903312AE15EF0F4FC48975007F5893BE59FC7025975E56F91290EFEBF75A6B0D9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369319410410021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4cbd6e00-c3a3-46b5-909a-5e5cc25537ec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.565191175210451
Encrypted:	false
SSDEEP:	768:PYEgD1ZM7pLGLvqvWPWwfcu8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4aygGp0rw/dT:P121ZwcvqvWPWwfcuu1jahayRptVdtfj
MD5:	10123C1E6E67021D793FAFB70F7B6480
SHA1:	0782685D20A459ADF915D138F15F1D9CD8C3343B
SHA-256:	A61289E10C5D7F31DFDF9BAC3EED42CA70C1416F8FDB9CF000BD07FB5AF180D2
SHA-512:	22A8AFF1B446C529144265F715E3D7F952425DD200C679924C7B71217659D8E7CBDC09F82765EBE96899E308C1015675974B775D28FAB12E9784183AF23630BA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369319410086286","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369319410086286","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.320558238866832
Encrypted:	false
SSDEEP:	192:nAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:AOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	75B315D1014E432150E1805FE161A3D9
SHA1:	D5155011B4AA3CC2A83535AC50A11B1FFB1016EE
SHA-256:	3C4B23DBB910E103D8794EFB546A5D33F57D81ABD01BA81B724F2FF21FDF4914
SHA-512:	924A7502593C4970943DA5B62352DC1C4A1FD09A552F3DE0365EF467AECAFC1D328E9781A8AD6FD341DAD4DC46817338C465D6C2DCC2CF215E9AE8AEA75991AA
Malicious:	false
Preview:	...m.................DB_VERSION.1S...................QUERY_TIMESTAMP:arbitration_priority_list4...13369319412105317.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.0734751160425535
Encrypted:	false
SSDEEP:	6:Nfs1wkn23oH+Tcwt9Eh1ZB2KLlLZq2Pwkn23oH+Tcwt9Eh1tIFUv:NfLfYeb9Eh1ZFL1ZvYfYeb9Eh16FUv
MD5:	78D35F1E81E5C026BDDED9EF427900F3
SHA1:	8D391985AB7CD4FFD03751DE75C44CE22A635DB6
SHA-256:	74CFED3FA27C98E178F226391FF0117CF1D4B922A0E8CB9706DD483FD3592C64
SHA-512:	625EA8B647CE2EC0196C1C4532D42F7238E00EE30C5A047A777150E670A42557B923727227240BB49BCBB618622C4A0D44109D15556F9E236FF977FFC941FDCD
Malicious:	false
Preview:	2024/08/28-07:50:11.300 da0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/28-07:50:11.348 da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl2K4ll:Ls321l
MD5:	FC009300EAF20BAC780173BBEDFE9739
SHA1:	BA5ECF5B230B1CC0D0AF3CF3C0A7B473A3BC9384
SHA-256:	8F8F6BBD0686DD14B4F0CE4C4548461AEEC53BF4E66A10FA6AAA6B3717325D44
SHA-512:	A7E13379E42B827BF11B77F1ADD9C5E781F6F061C781A4CB177AC5B0F0D1D43BB07DBD389B67C694EDCA0689810398475A629CB603C498C78D0F75157B9E5338
Malicious:	false
Preview:	.........................................fY>S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.175059877324365
Encrypted:	false
SSDEEP:	6:N07D1wkn23oH+TcwtnG2tbB2KLlL2N3+q2Pwkn23oH+TcwtnG2tMsIFUv:NGyfYebn9VFL124vYfYebn9GFUv
MD5:	071201BABBA4B1927127D891881603CF
SHA1:	9D3012AA1ADBBC2B414B136F8BEE629135FF2E57
SHA-256:	A0B0EDBD7930479CB32C578C9C4CF835DD2B02927FFAA64CCB594504847A9367
SHA-512:	C8162A83CADE1D0C86683B07552909F8B9CC9433278161414C9C607815853E645B0285B71C19C686C84EB4DD991BB6D6E46801675DFCEC0403D448F2FD37D1C6
Malicious:	false
Preview:	2024/08/28-07:50:10.101 21b8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/28-07:50:10.125 21b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.113758119168819
Encrypted:	false
SSDEEP:	6:N0S1wkn23oH+Tcwt8aVdg2KLlL5t+q2Pwkn23oH+Tcwt8aPrqIFUv:NyfYeb0L1qvYfYebL3FUv
MD5:	B3B563F68ABAD574A02F2AD6102D9E2D
SHA1:	B6EA2ECE6D6F4369706444077F4A72EF5FF5821D
SHA-256:	BEDAA4EBBAB83120DCC81F575231467D729F7737860EBBE07D4B44C93478D5D9
SHA-512:	52A6F285CF0AF4D382CF032697311B527986E88CE4D0AB0E039AED7DBE7914C1AC6453B578B352776894FA6E06636DE5DAE8DC2D31D3219BD4FF86E7388398D6
Malicious:	false
Preview:	2024/08/28-07:50:10.101 2228 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/28-07:50:10.150 2228 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.128234995945081
Encrypted:	false
SSDEEP:	6:NwHj1wkn23oH+Tcwt86FB2KLlLydP+q2Pwkn23oH+Tcwt865IFUv:NwyfYeb/FFL1y4vYfYeb/WFUv
MD5:	934D0547C60FF819906599DD254F2DB6
SHA1:	B9718D217503827EB61B9033A3FDFD1AEC36A5F1
SHA-256:	EE5FE92513C66D1A0433800D763624A33BFE634E367FB8220089D570B53D37D5
SHA-512:	9A8E8714D1C8E5665B417FFDA6F76979CF3BEF99819814A9F01ACF064A0B138905CF7F20FB4D7952297277D558B355A3389932037E59E2D95CDC46C473BA5755
Malicious:	false
Preview:	2024/08/28-07:50:10.151 2228 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/28-07:50:10.168 2228 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.167436293470155
Encrypted:	false
SSDEEP:	6:NnROq2Pwkn23oH+Tcwt8NIFUt88qZmw+8WkwOwkn23oH+Tcwt8+eLJ:NnMvYfYebpFUt88q/+8W5JfYebqJ
MD5:	BA11C23166DA459384721A26729E23E1
SHA1:	861746E3E50228CDCE254FDFBFAF50AB44F390CC
SHA-256:	15C52FCD1D417146A3A62936BFC8619D6D537BEE4ACEA1380CF161283BBAD345
SHA-512:	32D502C3D92F1A8E61DF806512F71458CB5DF0B84275CEB33A3E7F4759FA77A903C061989C1808037D32C1AAECF0F345C81A20F87A13F58B08677A0BA03BC04E
Malicious:	false
Preview:	2024/08/28-07:50:10.371 7d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/28-07:50:10.372 7d4 Recovering log #3.2024/08/28-07:50:10.372 7d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.167436293470155
Encrypted:	false
SSDEEP:	6:NnROq2Pwkn23oH+Tcwt8NIFUt88qZmw+8WkwOwkn23oH+Tcwt8+eLJ:NnMvYfYebpFUt88q/+8W5JfYebqJ
MD5:	BA11C23166DA459384721A26729E23E1
SHA1:	861746E3E50228CDCE254FDFBFAF50AB44F390CC
SHA-256:	15C52FCD1D417146A3A62936BFC8619D6D537BEE4ACEA1380CF161283BBAD345
SHA-512:	32D502C3D92F1A8E61DF806512F71458CB5DF0B84275CEB33A3E7F4759FA77A903C061989C1808037D32C1AAECF0F345C81A20F87A13F58B08677A0BA03BC04E
Malicious:	false
Preview:	2024/08/28-07:50:10.371 7d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/28-07:50:10.372 7d4 Recovering log #3.2024/08/28-07:50:10.372 7d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.32872990409968056
Encrypted:	false
SSDEEP:	6:qSiA/J3+t76Y4QZZofU99pO0BYHpqR4EZY4QZvGjl:DThHQws9LdlBQZGx
MD5:	E0412293D77F1508CF3965E9240E92F0
SHA1:	36AD4171C123EA59641B14BB706D598F922E42BD
SHA-256:	66A231B503C61DA20EA9F2318E1F490CC0DB3353F7B1C332E3AF4BADDC56B1C9
SHA-512:	A512160961DE57F85831294EB455524E4B25BFDDA5A87E6B161486F12899D5D48802DFAA7CB615FBB83F59C8A65A612E07121606F5D4243A02899001DB577067
Malicious:	false
Preview:	...................'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.26818958444195
Encrypted:	false
SSDEEP:	12:NgvYfYeb8rcHEZrELFUt88ts/+8tM5JfYeb8rcHEZrEZSJ:NSYfYeb8nZrExg88woJfYeb8nZrEZe
MD5:	FD239A1846FE474900F67A2FF18A3533
SHA1:	79516EFBDF85BFD41CC79B28B12CBF63B00A55A3
SHA-256:	2C4F5CA4548BD87D2DCD750546FED1C9315CE0ABCE6AF0D992D97FAECE83FDC1
SHA-512:	F7BE76D85A4D25C4A0EA5DC1633F48292522D84ED74DE08F1A9AA80D0E7B5508BD3FE0B8F6EA6F59619F451CB0D580ECAFCD6DD3A26FF67114C36BD733B430DA
Malicious:	false
Preview:	2024/08/28-07:50:11.147 7d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/28-07:50:11.148 7d4 Recovering log #3.2024/08/28-07:50:11.148 7d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.26818958444195
Encrypted:	false
SSDEEP:	12:NgvYfYeb8rcHEZrELFUt88ts/+8tM5JfYeb8rcHEZrEZSJ:NSYfYeb8nZrExg88woJfYeb8nZrEZe
MD5:	FD239A1846FE474900F67A2FF18A3533
SHA1:	79516EFBDF85BFD41CC79B28B12CBF63B00A55A3
SHA-256:	2C4F5CA4548BD87D2DCD750546FED1C9315CE0ABCE6AF0D992D97FAECE83FDC1
SHA-512:	F7BE76D85A4D25C4A0EA5DC1633F48292522D84ED74DE08F1A9AA80D0E7B5508BD3FE0B8F6EA6F59619F451CB0D580ECAFCD6DD3A26FF67114C36BD733B430DA
Malicious:	false
Preview:	2024/08/28-07:50:11.147 7d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/28-07:50:11.148 7d4 Recovering log #3.2024/08/28-07:50:11.148 7d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.134206777003903
Encrypted:	false
SSDEEP:	6:NlByq2Pwkn23oH+Tcwt8a2jMGIFUt88lJ0Fz1Zmw+8lVZS9RkwOwkn23oH+Tcwtw:NryvYfYeb8EFUt88vQ/+8jgR5JfYeb8N
MD5:	FF24BEFAA1B8E1F55341B9E3200686A7
SHA1:	C5C0CE1E948556C9C3BB2C5A038CDEDD2DEF031B
SHA-256:	15B0ABA4BA601E5C3901DE6140D53D925A6848644377E93E1148A0CA98B12A77
SHA-512:	9C2A838D265ED19FFFE3241D003C2FD255466642A7E88E67A85A67A9ED38D1C62DAC65F0601AD813AC9F2649C2E23DFAAEEC1A578377693C274764CB72892FDE
Malicious:	false
Preview:	2024/08/28-07:50:10.827 1e70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/28-07:50:10.831 1e70 Recovering log #3.2024/08/28-07:50:10.835 1e70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.134206777003903
Encrypted:	false
SSDEEP:	6:NlByq2Pwkn23oH+Tcwt8a2jMGIFUt88lJ0Fz1Zmw+8lVZS9RkwOwkn23oH+Tcwtw:NryvYfYeb8EFUt88vQ/+8jgR5JfYeb8N
MD5:	FF24BEFAA1B8E1F55341B9E3200686A7
SHA1:	C5C0CE1E948556C9C3BB2C5A038CDEDD2DEF031B
SHA-256:	15B0ABA4BA601E5C3901DE6140D53D925A6848644377E93E1148A0CA98B12A77
SHA-512:	9C2A838D265ED19FFFE3241D003C2FD255466642A7E88E67A85A67A9ED38D1C62DAC65F0601AD813AC9F2649C2E23DFAAEEC1A578377693C274764CB72892FDE
Malicious:	false
Preview:	2024/08/28-07:50:10.827 1e70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/28-07:50:10.831 1e70 Recovering log #3.2024/08/28-07:50:10.835 1e70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0b559543-d06c-428c-8cd6-c089228d4ede.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\33015fc8-cd78-45a5-b275-34317aa0c068.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\489a8b5b-31d4-4649-a815-648cbf012599.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.296120728944576
Encrypted:	false
SSDEEP:	24:YXsEZVMdBsltZFRudFGcs4JZFGJ/dbG7nby:YXs88s9fcds4/gzbZ
MD5:	2CE75646CE530EA4425F59C5AE03389F
SHA1:	C5B106B6A985452A8F57C6D2385508F5310BE346
SHA-256:	01CC2EE603BDF068B6D881A30DB64AFA837DB166065F539ADDC2015B01FDB8C0
SHA-512:	4CCF57F4AE3AE111F3FA667FF2928769CE878264EFDE51A43B32780A91DB0D3D2ABBBCDA7F5ADEAD9E58839A6D1F5A64FC5D611AADC3CC242F3855555331ABE4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371911412111673","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371911413792029","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371911416510962","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\83b8e05d-621f-4a8a-b352-6dae1cd4b4ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\93509e9b-2680-4d5d-a5bd-8e89f229f70b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2ec0c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3d9a8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2c624.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2d5b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2ec0c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a65be1ce-f9d5-4745-bf64-19523b2c12e3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ff5d9fdc-da66-4ec7-911c-4a55115b6ff7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.06474551203299
Encrypted:	false
SSDEEP:	96:sVvYqlWJ1orb9CP+9mqXzYAMsY5Th6Cp9/x+6M8muecmAeC/e4zvrM2X6gE5AtE7:sVwJJRG9mqjYAMsYPpj+FVAbMFBf
MD5:	EDD08D0D8E6C57C12486D388E2083A99
SHA1:	8E0B18CBF1B124802F73B91BE784163EBD460980
SHA-256:	15699BE24C7549FFD64CDA0672874A941CF3A799726A204A0D231A210DE650AD
SHA-512:	4B3696CEF8AC670F595E6672CE8897CCE985FE40322FF7BDF89F26592FFE7449E292EF97CC8287664C4963EF4A6E50BE0BBBA08CCAA5603C95CBB2A1DD892C43
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369319410410021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF343f0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.06474551203299
Encrypted:	false
SSDEEP:	96:sVvYqlWJ1orb9CP+9mqXzYAMsY5Th6Cp9/x+6M8muecmAeC/e4zvrM2X6gE5AtE7:sVwJJRG9mqjYAMsYPpj+FVAbMFBf
MD5:	EDD08D0D8E6C57C12486D388E2083A99
SHA1:	8E0B18CBF1B124802F73B91BE784163EBD460980
SHA-256:	15699BE24C7549FFD64CDA0672874A941CF3A799726A204A0D231A210DE650AD
SHA-512:	4B3696CEF8AC670F595E6672CE8897CCE985FE40322FF7BDF89F26592FFE7449E292EF97CC8287664C4963EF4A6E50BE0BBBA08CCAA5603C95CBB2A1DD892C43
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369319410410021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d199.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.06474551203299
Encrypted:	false
SSDEEP:	96:sVvYqlWJ1orb9CP+9mqXzYAMsY5Th6Cp9/x+6M8muecmAeC/e4zvrM2X6gE5AtE7:sVwJJRG9mqjYAMsYPpj+FVAbMFBf
MD5:	EDD08D0D8E6C57C12486D388E2083A99
SHA1:	8E0B18CBF1B124802F73B91BE784163EBD460980
SHA-256:	15699BE24C7549FFD64CDA0672874A941CF3A799726A204A0D231A210DE650AD
SHA-512:	4B3696CEF8AC670F595E6672CE8897CCE985FE40322FF7BDF89F26592FFE7449E292EF97CC8287664C4963EF4A6E50BE0BBBA08CCAA5603C95CBB2A1DD892C43
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369319410410021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557395227049182
Encrypted:	false
SSDEEP:	768:PYEgD1ZM7pLGLvqvWPWwfvu8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhgGp0rwt6phX:P121ZwcvqvWPWwfvuu1jaURptt8dtf
MD5:	EDA7A821B10D7F06FC8AD8B3CABEDEA0
SHA1:	AAFB9D1B0AA3AA703BD8FF3B9921EB4F45F92673
SHA-256:	EAB9D7EA1878FEB928CA8CFE98A06FABD6D60F1392971B8A74280B1C4D607CB4
SHA-512:	912B4B63CF5BFD9F6051D6F0A82FCD4F6B2231AB20870FD2B5B337FA7FEE9B262C27513040295481D94655ADB001847BD19594486D5F6F044DCD4591D7E0260F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369319410086286","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369319410086286","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF32636.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557395227049182
Encrypted:	false
SSDEEP:	768:PYEgD1ZM7pLGLvqvWPWwfvu8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhgGp0rwt6phX:P121ZwcvqvWPWwfvuu1jaURptt8dtf
MD5:	EDA7A821B10D7F06FC8AD8B3CABEDEA0
SHA1:	AAFB9D1B0AA3AA703BD8FF3B9921EB4F45F92673
SHA-256:	EAB9D7EA1878FEB928CA8CFE98A06FABD6D60F1392971B8A74280B1C4D607CB4
SHA-512:	912B4B63CF5BFD9F6051D6F0A82FCD4F6B2231AB20870FD2B5B337FA7FEE9B262C27513040295481D94655ADB001847BD19594486D5F6F044DCD4591D7E0260F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369319410086286","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369319410086286","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.149487731648256
Encrypted:	false
SSDEEP:	6:NrrGyq2Pwkn23oH+TcwtrQMxIFUt88r+21Zmw+8rM0jRkwOwkn23oH+TcwtrQMFd:NrSyvYfYebCFUt88r+Q/+8r3R5JfYebf
MD5:	D94AE70B2209DAA61EE307EB79AFE0BB
SHA1:	86C2C0BA7049E23FB4DC9F45E5BCD7B2B9CB8B96
SHA-256:	A5461614A974AE06E7414FAA6D2A5198B7C0AC1C1538338F6982C718BE9408AC
SHA-512:	24114AB8775739CCA6BF0B66629352C99A30692B1B063E66FF778ED3BA5B4BDE08CE1CEBC0AB06E3411221704B7952AA11D235D1A52EE990BB1489376B11B81C
Malicious:	false
Preview:	2024/08/28-07:50:25.976 1e70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/28-07:50:25.977 1e70 Recovering log #3.2024/08/28-07:50:25.979 1e70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.149487731648256
Encrypted:	false
SSDEEP:	6:NrrGyq2Pwkn23oH+TcwtrQMxIFUt88r+21Zmw+8rM0jRkwOwkn23oH+TcwtrQMFd:NrSyvYfYebCFUt88r+Q/+8r3R5JfYebf
MD5:	D94AE70B2209DAA61EE307EB79AFE0BB
SHA1:	86C2C0BA7049E23FB4DC9F45E5BCD7B2B9CB8B96
SHA-256:	A5461614A974AE06E7414FAA6D2A5198B7C0AC1C1538338F6982C718BE9408AC
SHA-512:	24114AB8775739CCA6BF0B66629352C99A30692B1B063E66FF778ED3BA5B4BDE08CE1CEBC0AB06E3411221704B7952AA11D235D1A52EE990BB1489376B11B81C
Malicious:	false
Preview:	2024/08/28-07:50:25.976 1e70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/28-07:50:25.977 1e70 Recovering log #3.2024/08/28-07:50:25.979 1e70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.115671260506188
Encrypted:	false
SSDEEP:	6:NtM+q2Pwkn23oH+Tcwt7Uh2ghZIFUt88thlX5Zmw+8thlXtVkwOwkn23oH+Tcwts:NHvYfYebIhHh2FUt88F5/+8FT5JfYebs
MD5:	F09DC602D5A6EEAB7FCA319AC2F94EC7
SHA1:	40AACD5702D81C66B7DB319C4DB20697FBFDEB28
SHA-256:	BD9ED2F66DA57B77D0D533040F1373117A6500F122B5DCE32C1686C1CE3F7273
SHA-512:	C671644C3BCC1A3A5D31FC9305C0CEF1B7E80F6CDF1102C1CE7D80749E5C0902D8F0B3CF2AE1FB36A2856D7CCEF656F78C9EE60162718826957F031219562E12
Malicious:	false
Preview:	2024/08/28-07:50:10.092 2228 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/28-07:50:10.095 2228 Recovering log #3.2024/08/28-07:50:10.095 2228 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.115671260506188
Encrypted:	false
SSDEEP:	6:NtM+q2Pwkn23oH+Tcwt7Uh2ghZIFUt88thlX5Zmw+8thlXtVkwOwkn23oH+Tcwts:NHvYfYebIhHh2FUt88F5/+8FT5JfYebs
MD5:	F09DC602D5A6EEAB7FCA319AC2F94EC7
SHA1:	40AACD5702D81C66B7DB319C4DB20697FBFDEB28
SHA-256:	BD9ED2F66DA57B77D0D533040F1373117A6500F122B5DCE32C1686C1CE3F7273
SHA-512:	C671644C3BCC1A3A5D31FC9305C0CEF1B7E80F6CDF1102C1CE7D80749E5C0902D8F0B3CF2AE1FB36A2856D7CCEF656F78C9EE60162718826957F031219562E12
Malicious:	false
Preview:	2024/08/28-07:50:10.092 2228 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/28-07:50:10.095 2228 Recovering log #3.2024/08/28-07:50:10.095 2228 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:LsulZ2Bl/:LsIol
MD5:	10AD695371DC6C87AAF4C5DB05B8C1E3
SHA1:	9AB9BFF9B771FD23747F02C48CE6729F3B8F9E18
SHA-256:	ED6C5490DF477E7B9CCE0BC38F2C595CBD36A2F3DF6E9F7BB45E74AC45E77EC9
SHA-512:	BBA9D6AD0D214B087FBCB2E358E54E42A96BA1CE6CB296A562F3EDF79641D4C43AAD0D1C10A9C608AC79B132B7AFFDDBBAEF142B11B146247FB1875221BD525B
Malicious:	false
Preview:	........................................bS.>S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl1E:Ls3
MD5:	4EA521BECF42353DBF71F2FC093D7EA7
SHA1:	8FD98534AE546CB8B034E12C3E2EEAE07FC17478
SHA-256:	D43D806C1E63E7B7561DCE69A32D8D42023BE85ADC4CAA626B0AC5784CA65453
SHA-512:	07A1312F19157A02101E0532ED06435E09CC04BFA50E22C22EA6DE4594FB1D26A66534D7A57197E23FA7F2C402AC21425EA9E946DFCAE45AD578B4DD4288FBA9
Malicious:	false
Preview:	.........................................)Z>S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.2367575053347775
Encrypted:	false
SSDEEP:	12:NyZeyvYfYebvqBQFUt883/+88VjR5JfYebvqBvJ:NiYfYebvZg88dEXJfYebvk
MD5:	BBBD6B3EC1F8CB8A790E1D7031E42A05
SHA1:	B193819B90B5096B8C3FD5FE2241B62B3326E2C6
SHA-256:	BD42FF8CF2D071E1493B888E9BC1B488A80544AD7D14100544E729206D559CD4
SHA-512:	9838F9A81F1339F22A956A1814FAED038A259529F936D5C77894BB2484601DB0721292ADC23A3702DC7EFDE3FB20029291ADCBCE705B1F249EE7883806E62827
Malicious:	false
Preview:	2024/08/28-07:50:10.847 1e70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/28-07:50:10.849 1e70 Recovering log #3.2024/08/28-07:50:10.853 1e70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.2367575053347775
Encrypted:	false
SSDEEP:	12:NyZeyvYfYebvqBQFUt883/+88VjR5JfYebvqBvJ:NiYfYebvZg88dEXJfYebvk
MD5:	BBBD6B3EC1F8CB8A790E1D7031E42A05
SHA1:	B193819B90B5096B8C3FD5FE2241B62B3326E2C6
SHA-256:	BD42FF8CF2D071E1493B888E9BC1B488A80544AD7D14100544E729206D559CD4
SHA-512:	9838F9A81F1339F22A956A1814FAED038A259529F936D5C77894BB2484601DB0721292ADC23A3702DC7EFDE3FB20029291ADCBCE705B1F249EE7883806E62827
Malicious:	false
Preview:	2024/08/28-07:50:10.847 1e70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/28-07:50:10.849 1e70 Recovering log #3.2024/08/28-07:50:10.853 1e70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\25aca58b-1836-4bc0-9c0e-f5a92db68d12.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\33703b7b-154d-4872-bf56-c6afb7b1fbc8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\36392a33-3073-4e05-bb6d-af6818c898c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\51520024-e51b-43da-b6d7-bb13b885c262.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3e9b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2d5b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.250939581069215
Encrypted:	false
SSDEEP:	12:NNyvYfYebvqBZFUt88e/+8hNR5JfYebvqBaJ:NCYfYebvyg888hdJfYebvL
MD5:	C9147AFDB75AD78A6307C851B808FC84
SHA1:	DF19A5322400886ADE8F899406F1C8C68B900730
SHA-256:	2DA55E35638807BE1E69408F9BDF72028F98B4DE69CBA4DCD3E6BCDD5965575D
SHA-512:	E9E9B56ACA134FACE6568C0742DC53D2669B9583BBA8693AB4D1DA5A27C085C052AB47D55345D53E969ABFCFE748268E0AC399518AF0B752301FA53795F3B2A3
Malicious:	false
Preview:	2024/08/28-07:50:26.196 1e70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/28-07:50:26.197 1e70 Recovering log #3.2024/08/28-07:50:26.200 1e70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.250939581069215
Encrypted:	false
SSDEEP:	12:NNyvYfYebvqBZFUt88e/+8hNR5JfYebvqBaJ:NCYfYebvyg888hdJfYebvL
MD5:	C9147AFDB75AD78A6307C851B808FC84
SHA1:	DF19A5322400886ADE8F899406F1C8C68B900730
SHA-256:	2DA55E35638807BE1E69408F9BDF72028F98B4DE69CBA4DCD3E6BCDD5965575D
SHA-512:	E9E9B56ACA134FACE6568C0742DC53D2669B9583BBA8693AB4D1DA5A27C085C052AB47D55345D53E969ABFCFE748268E0AC399518AF0B752301FA53795F3B2A3
Malicious:	false
Preview:	2024/08/28-07:50:26.196 1e70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/28-07:50:26.197 1e70 Recovering log #3.2024/08/28-07:50:26.200 1e70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.224000434133529
Encrypted:	false
SSDEEP:	6:NtntZ+q2Pwkn23oH+TcwtpIFUt88tnt1Zmw+8tntZVkwOwkn23oH+Tcwta/WLJ:NZtZ+vYfYebmFUt88Zt1/+8ZtZV5JfYM
MD5:	0AE7C372443E9EC24ADDEA048BE13F6B
SHA1:	23ABA8FFFFBF5A385394842E880A7F93D3DC3886
SHA-256:	4F724B7A183CF986B4B506BF7069DAACF8D5D47CE2AE3C32A9BEFCE1DB2865DB
SHA-512:	B5C1CCA2D9F3DBE367718E37B61ED62DDE4B9274088122B3EC7CFFB3511A1B50A4211FC77E154E9E2E33564B4E769A776956A85C87329BA23D186D2ED68CCEDE
Malicious:	false
Preview:	2024/08/28-07:50:10.093 21bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/28-07:50:10.093 21bc Recovering log #3.2024/08/28-07:50:10.093 21bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.224000434133529
Encrypted:	false
SSDEEP:	6:NtntZ+q2Pwkn23oH+TcwtpIFUt88tnt1Zmw+8tntZVkwOwkn23oH+Tcwta/WLJ:NZtZ+vYfYebmFUt88Zt1/+8ZtZV5JfYM
MD5:	0AE7C372443E9EC24ADDEA048BE13F6B
SHA1:	23ABA8FFFFBF5A385394842E880A7F93D3DC3886
SHA-256:	4F724B7A183CF986B4B506BF7069DAACF8D5D47CE2AE3C32A9BEFCE1DB2865DB
SHA-512:	B5C1CCA2D9F3DBE367718E37B61ED62DDE4B9274088122B3EC7CFFB3511A1B50A4211FC77E154E9E2E33564B4E769A776956A85C87329BA23D186D2ED68CCEDE
Malicious:	false
Preview:	2024/08/28-07:50:10.093 21bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/28-07:50:10.093 21bc Recovering log #3.2024/08/28-07:50:10.093 21bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:T/lyHl1lhtlJn:O3Z
MD5:	D1D2A9B92CB34AAC745C956ED6E72EE3
SHA1:	A32596840EE8996573425B6D161D76202DA967F0
SHA-256:	9F20F19944D5862FC04DFA5091AF0D25821BAC46EB469EC64392F889F728C858
SHA-512:	B0BED8B0FDB1E2B72A8555249D9D60BC991AA718C20755B257969DEEEF17A5DD2A9444C1C5E8F440337A6018A8C450D06AEF9BA140650F89D5FC920ED41FEA8B
Malicious:	false
Preview:	.............V.>...W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f677acda-a7e8-4b85-a8fa-23663ebe5149.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557395227049182
Encrypted:	false
SSDEEP:	768:PYEgD1ZM7pLGLvqvWPWwfvu8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhgGp0rwt6phX:P121ZwcvqvWPWwfvuu1jaURptt8dtf
MD5:	EDA7A821B10D7F06FC8AD8B3CABEDEA0
SHA1:	AAFB9D1B0AA3AA703BD8FF3B9921EB4F45F92673
SHA-256:	EAB9D7EA1878FEB928CA8CFE98A06FABD6D60F1392971B8A74280B1C4D607CB4
SHA-512:	912B4B63CF5BFD9F6051D6F0A82FCD4F6B2231AB20870FD2B5B337FA7FEE9B262C27513040295481D94655ADB001847BD19594486D5F6F044DCD4591D7E0260F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369319410086286","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369319410086286","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.307361565765853
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQvxlfp+mtl3seGKT9rcQ6xdbILUtl:/XntM+4lIil3sedhO6U
MD5:	6938B5EF0DEA83FDAF9D442EEAF64085
SHA1:	DA757B243C1E9F04D064013743B8BA1C5C92B01B
SHA-256:	E36654F5C1D957A028821BE4D1A5EFD2A75EACB18171CB623D3128CBEC4061D0
SHA-512:	BC1E8885FDFF0B4D69BD0F38B3C935E826BB475D98553F91B36BEFC56D1EE816BFBA8D3ACD6AC6BBAA2C14C59DB559CEEA9E5695E6CA42C22F0FE7375E72BF89
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f................l..0................39_config..........6.....n ...1u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.227825664138356
Encrypted:	false
SSDEEP:	6:Ncv5eq1wkn23oH+Tcwtfrl2KLlLoQL+q2Pwkn23oH+TcwtfrK+IFUv:NASfYeb1L1NyvYfYeb23FUv
MD5:	62534BF872DA3A3022834FA2FBEE6949
SHA1:	AC255CC4BDC3F75F9EB3A1943BD449EB7E5E7946
SHA-256:	38D2D677A22CC860B89C4739F7C6CF55A66383150FC2C36AFB6A932BDF7D5DD9
SHA-512:	888FBE6F4A4582F9A731D4B8256D34BF5084100513C52DBBEEA050DACA16E7D4E27CCED44E1B539C26D2AD8E7AB0CDE00F9FB8A6B18EFE965F6C6BBC8D9A6391
Malicious:	false
Preview:	2024/08/28-07:50:10.360 1d18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/28-07:50:10.374 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9275169283101077
Encrypted:	false
SSDEEP:	12:G0nYUtTNVrPzl6/5/Xt21tzJ3PEWXZi+5uh/2Rdj0QWQ0:G0nYUtPrPJ6B/XMtzNP9i+4hORdZx0
MD5:	A21ADD072F290BB8025555CE1EF9014C
SHA1:	BC07D222EF610DCE637F72866D14D7560926EB5C
SHA-256:	1D64B6F3EBA3FC479C8A8A34AB1D17D263E71AC35707450E323DA7E482E48195
SHA-512:	164C693EE34EE72E4401DFF69B7E4CFE2BA100E7F3C8D2665B91BFC200011F808FEF9EB878656CE54478EF7F6B814EAD722C4EDC74F7300BA5E1B696F6CA1CCF
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....s/<..................19_........e.................18_......E...................37_.....`0M..................38_......Hf..................39_.......w<.................20_.........................20_..........................19_.....}....................18_......m=.................37_.....uTN..................38_.......h.................39_........I.................21_......j...................21_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.181235514892395
Encrypted:	false
SSDEEP:	6:NeVq1wkn23oH+Tcwtfrzs52KLlLySQL+q2Pwkn23oH+TcwtfrzAdIFUv:NeXfYebs9L1yjyvYfYeb9FUv
MD5:	9009A36CCDB574F71F89DE6B626A78C0
SHA1:	42F1C9B04CE3B1EF6432E0D4A867FEDA39552FEC
SHA-256:	6AB148445460895ED93FF203AB587615272111236EA7CD0C5D2B8964BB2C028D
SHA-512:	DE9FF6EDD97C400865E9DC859AE0AF749AEB90F0D280D0C60603C66304BDD7728069EE9E376AA0F3A33AFF32A079BEAC5B48502EF1322B45FB890C85C61552E6
Malicious:	false
Preview:	2024/08/28-07:50:10.341 1d18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/28-07:50:10.357 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlxKt:Ls3
MD5:	CE1BF1EE9D434357B108209768496CA2
SHA1:	32A1626F8AF866AF47FC0CA54C455F091530EE10
SHA-256:	7E9D441894AD2B16A65087B102FB33443564D118891FB3148C548DE5A6062006
SHA-512:	B6360632AB5E19DCAC598C4565506C09A86F04FA4854D976FF4B447B8678F033FF57EF7CF21D2205191ED1505334E2AAB02261B42167B5A33D8E6D14602F7560
Malicious:	false
Preview:	........................................Pfd>S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlZl:Ls3Z
MD5:	E24A6825505C348C3EB2812264054E21
SHA1:	A399114ACEC7A85FBD3B897CD79D5F8D14CB78D9
SHA-256:	5C3777C33626C69C4042D80EAA8C5BB0E1CBB2F7142CB0A13004AB98385523CB
SHA-512:	D23947AC8F0CAD8C70BDDEFC7E3085183EFF9923A4B941671F22C12840C10BCD204F1BDDD522EE85277E51A5134FEA6187AE8BFFBA41A84B4CCAC17AE211696A
Malicious:	false
Preview:	..........................................e>S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793081437040778
Encrypted:	false
SSDEEP:	96:iaqkHfHmb5ih/cI9URLl8RotonMFVvlwhWe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akP7eiRUEh26qRAq1k8SPxVLZ7VTiq
MD5:	D38AAB5B978BBBED027256487EF9BF2C
SHA1:	43DD71C36669BD8C05BADB69735ED7467BA4536F
SHA-256:	66B12BA154FEBFA0A54966EE7216E095CB0A3EEB0DE615D8D2447FAE00FA5F20
SHA-512:	8E1087914A2B2F428CB083803585AD908565CF529200006B66BCE5F8E0D21508C0E5C71636F76281EA5672E4AD1D1A59E6D40273FD2C36CC8C23F0654733CAB4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADtRbm4kf504FQIjz5dsvPhbQnP4EfnJFN63zrs2/urLAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2c048.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793081437040778
Encrypted:	false
SSDEEP:	96:iaqkHfHmb5ih/cI9URLl8RotonMFVvlwhWe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akP7eiRUEh26qRAq1k8SPxVLZ7VTiq
MD5:	D38AAB5B978BBBED027256487EF9BF2C
SHA1:	43DD71C36669BD8C05BADB69735ED7467BA4536F
SHA-256:	66B12BA154FEBFA0A54966EE7216E095CB0A3EEB0DE615D8D2447FAE00FA5F20
SHA-512:	8E1087914A2B2F428CB083803585AD908565CF529200006B66BCE5F8E0D21508C0E5C71636F76281EA5672E4AD1D1A59E6D40273FD2C36CC8C23F0654733CAB4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADtRbm4kf504FQIjz5dsvPhbQnP4EfnJFN63zrs2/urLAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2c068.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793081437040778
Encrypted:	false
SSDEEP:	96:iaqkHfHmb5ih/cI9URLl8RotonMFVvlwhWe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akP7eiRUEh26qRAq1k8SPxVLZ7VTiq
MD5:	D38AAB5B978BBBED027256487EF9BF2C
SHA1:	43DD71C36669BD8C05BADB69735ED7467BA4536F
SHA-256:	66B12BA154FEBFA0A54966EE7216E095CB0A3EEB0DE615D8D2447FAE00FA5F20
SHA-512:	8E1087914A2B2F428CB083803585AD908565CF529200006B66BCE5F8E0D21508C0E5C71636F76281EA5672E4AD1D1A59E6D40273FD2C36CC8C23F0654733CAB4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADtRbm4kf504FQIjz5dsvPhbQnP4EfnJFN63zrs2/urLAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e073.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793081437040778
Encrypted:	false
SSDEEP:	96:iaqkHfHmb5ih/cI9URLl8RotonMFVvlwhWe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akP7eiRUEh26qRAq1k8SPxVLZ7VTiq
MD5:	D38AAB5B978BBBED027256487EF9BF2C
SHA1:	43DD71C36669BD8C05BADB69735ED7467BA4536F
SHA-256:	66B12BA154FEBFA0A54966EE7216E095CB0A3EEB0DE615D8D2447FAE00FA5F20
SHA-512:	8E1087914A2B2F428CB083803585AD908565CF529200006B66BCE5F8E0D21508C0E5C71636F76281EA5672E4AD1D1A59E6D40273FD2C36CC8C23F0654733CAB4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADtRbm4kf504FQIjz5dsvPhbQnP4EfnJFN63zrs2/urLAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e0a2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793081437040778
Encrypted:	false
SSDEEP:	96:iaqkHfHmb5ih/cI9URLl8RotonMFVvlwhWe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akP7eiRUEh26qRAq1k8SPxVLZ7VTiq
MD5:	D38AAB5B978BBBED027256487EF9BF2C
SHA1:	43DD71C36669BD8C05BADB69735ED7467BA4536F
SHA-256:	66B12BA154FEBFA0A54966EE7216E095CB0A3EEB0DE615D8D2447FAE00FA5F20
SHA-512:	8E1087914A2B2F428CB083803585AD908565CF529200006B66BCE5F8E0D21508C0E5C71636F76281EA5672E4AD1D1A59E6D40273FD2C36CC8C23F0654733CAB4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADtRbm4kf504FQIjz5dsvPhbQnP4EfnJFN63zrs2/urLAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e0f0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793081437040778
Encrypted:	false
SSDEEP:	96:iaqkHfHmb5ih/cI9URLl8RotonMFVvlwhWe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akP7eiRUEh26qRAq1k8SPxVLZ7VTiq
MD5:	D38AAB5B978BBBED027256487EF9BF2C
SHA1:	43DD71C36669BD8C05BADB69735ED7467BA4536F
SHA-256:	66B12BA154FEBFA0A54966EE7216E095CB0A3EEB0DE615D8D2447FAE00FA5F20
SHA-512:	8E1087914A2B2F428CB083803585AD908565CF529200006B66BCE5F8E0D21508C0E5C71636F76281EA5672E4AD1D1A59E6D40273FD2C36CC8C23F0654733CAB4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADtRbm4kf504FQIjz5dsvPhbQnP4EfnJFN63zrs2/urLAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30020.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793081437040778
Encrypted:	false
SSDEEP:	96:iaqkHfHmb5ih/cI9URLl8RotonMFVvlwhWe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akP7eiRUEh26qRAq1k8SPxVLZ7VTiq
MD5:	D38AAB5B978BBBED027256487EF9BF2C
SHA1:	43DD71C36669BD8C05BADB69735ED7467BA4536F
SHA-256:	66B12BA154FEBFA0A54966EE7216E095CB0A3EEB0DE615D8D2447FAE00FA5F20
SHA-512:	8E1087914A2B2F428CB083803585AD908565CF529200006B66BCE5F8E0D21508C0E5C71636F76281EA5672E4AD1D1A59E6D40273FD2C36CC8C23F0654733CAB4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADtRbm4kf504FQIjz5dsvPhbQnP4EfnJFN63zrs2/urLAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3003f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793081437040778
Encrypted:	false
SSDEEP:	96:iaqkHfHmb5ih/cI9URLl8RotonMFVvlwhWe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akP7eiRUEh26qRAq1k8SPxVLZ7VTiq
MD5:	D38AAB5B978BBBED027256487EF9BF2C
SHA1:	43DD71C36669BD8C05BADB69735ED7467BA4536F
SHA-256:	66B12BA154FEBFA0A54966EE7216E095CB0A3EEB0DE615D8D2447FAE00FA5F20
SHA-512:	8E1087914A2B2F428CB083803585AD908565CF529200006B66BCE5F8E0D21508C0E5C71636F76281EA5672E4AD1D1A59E6D40273FD2C36CC8C23F0654733CAB4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADtRbm4kf504FQIjz5dsvPhbQnP4EfnJFN63zrs2/urLAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33365.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793081437040778
Encrypted:	false
SSDEEP:	96:iaqkHfHmb5ih/cI9URLl8RotonMFVvlwhWe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akP7eiRUEh26qRAq1k8SPxVLZ7VTiq
MD5:	D38AAB5B978BBBED027256487EF9BF2C
SHA1:	43DD71C36669BD8C05BADB69735ED7467BA4536F
SHA-256:	66B12BA154FEBFA0A54966EE7216E095CB0A3EEB0DE615D8D2447FAE00FA5F20
SHA-512:	8E1087914A2B2F428CB083803585AD908565CF529200006B66BCE5F8E0D21508C0E5C71636F76281EA5672E4AD1D1A59E6D40273FD2C36CC8C23F0654733CAB4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADtRbm4kf504FQIjz5dsvPhbQnP4EfnJFN63zrs2/urLAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3aa3b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793081437040778
Encrypted:	false
SSDEEP:	96:iaqkHfHmb5ih/cI9URLl8RotonMFVvlwhWe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akP7eiRUEh26qRAq1k8SPxVLZ7VTiq
MD5:	D38AAB5B978BBBED027256487EF9BF2C
SHA1:	43DD71C36669BD8C05BADB69735ED7467BA4536F
SHA-256:	66B12BA154FEBFA0A54966EE7216E095CB0A3EEB0DE615D8D2447FAE00FA5F20
SHA-512:	8E1087914A2B2F428CB083803585AD908565CF529200006B66BCE5F8E0D21508C0E5C71636F76281EA5672E4AD1D1A59E6D40273FD2C36CC8C23F0654733CAB4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADtRbm4kf504FQIjz5dsvPhbQnP4EfnJFN63zrs2/urLAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d15b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793081437040778
Encrypted:	false
SSDEEP:	96:iaqkHfHmb5ih/cI9URLl8RotonMFVvlwhWe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akP7eiRUEh26qRAq1k8SPxVLZ7VTiq
MD5:	D38AAB5B978BBBED027256487EF9BF2C
SHA1:	43DD71C36669BD8C05BADB69735ED7467BA4536F
SHA-256:	66B12BA154FEBFA0A54966EE7216E095CB0A3EEB0DE615D8D2447FAE00FA5F20
SHA-512:	8E1087914A2B2F428CB083803585AD908565CF529200006B66BCE5F8E0D21508C0E5C71636F76281EA5672E4AD1D1A59E6D40273FD2C36CC8C23F0654733CAB4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADtRbm4kf504FQIjz5dsvPhbQnP4EfnJFN63zrs2/urLAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42101.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793081437040778
Encrypted:	false
SSDEEP:	96:iaqkHfHmb5ih/cI9URLl8RotonMFVvlwhWe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akP7eiRUEh26qRAq1k8SPxVLZ7VTiq
MD5:	D38AAB5B978BBBED027256487EF9BF2C
SHA1:	43DD71C36669BD8C05BADB69735ED7467BA4536F
SHA-256:	66B12BA154FEBFA0A54966EE7216E095CB0A3EEB0DE615D8D2447FAE00FA5F20
SHA-512:	8E1087914A2B2F428CB083803585AD908565CF529200006B66BCE5F8E0D21508C0E5C71636F76281EA5672E4AD1D1A59E6D40273FD2C36CC8C23F0654733CAB4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACgSLUFcWLsQb9/oH8vSOkWEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADtRbm4kf504FQIjz5dsvPhbQnP4EfnJFN63zrs2/urLAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2031601
Entropy (8bit):	4.001535321868606
Encrypted:	false
SSDEEP:	49152:EgPh2N/ZRsDgVFulq6hTA7X4Vxf2H+lz7ASf4j1xeqOWlciRayjS09nnwBXQma/c:z
MD5:	1FE47129EE2CEB7A907BB916B9328375
SHA1:	E3999CB1F6DC4C67EFE5230D24FF7639B90B6270
SHA-256:	84EE1C7958471859E2E45CED3805C7EF5B5C6DED26F044D57D33334902D28D13
SHA-512:	A58F52BB8BFEF422CA56AF77898D26E4C624E12926DF8D5D2B75AA1779D49F99F7419020465094C4A34BE93459C59E8B6C5AC588DD1695F10E61D917E9DA98B7
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2031601
Entropy (8bit):	4.001535321868606
Encrypted:	false
SSDEEP:	49152:EgPh2N/ZRsDgVFulq6hTA7X4Vxf2H+lz7ASf4j1xeqOWlciRayjS09nnwBXQma/c:z
MD5:	1FE47129EE2CEB7A907BB916B9328375
SHA1:	E3999CB1F6DC4C67EFE5230D24FF7639B90B6270
SHA-256:	84EE1C7958471859E2E45CED3805C7EF5B5C6DED26F044D57D33334902D28D13
SHA-512:	A58F52BB8BFEF422CA56AF77898D26E4C624E12926DF8D5D2B75AA1779D49F99F7419020465094C4A34BE93459C59E8B6C5AC588DD1695F10E61D917E9DA98B7
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNl4bol/:Ls34k
MD5:	5AD6BC5231E69164CD912A4A18204BF2
SHA1:	6D7A3C854A28470BF974EC2761EC86BCF0EDE70C
SHA-256:	4EDEEFCE292F9D1ACB8D262956C6BBD6630AFE1C47B509A6A2C983AC3ECB1C15
SHA-512:	E6B50E7E63CC83790A28360809D889C7AEF096345C65BB428472E7BE6FD87528EE94FB1A52D0C66E4C72C6D4BFF3F5C1F75839329B4E0184AE9D6755B3FDA04B
Malicious:	false
Preview:	........................................J.R>S./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b2f4deaa-bc5d-4591-b486-d65e5fd7aaef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.798901854347082
Encrypted:	false
SSDEEP:	192:fsNwPaeiRUbzQ3kKP6qRAq1k8SPxVLZ7VTiQ:fsNw4S00KP6q3QxVNZTiQ
MD5:	C8677AA549DE0B8298B82BE9561FC033
SHA1:	3E5CD25C475EEB8A3DEE1628D040C95281D150AE
SHA-256:	9C58B9250FB92298F31FC2BE532CBED7246E233FC6DE4CA835B28B7AFE62A4E0
SHA-512:	0F6483733DEE47FDA0D0A9471A22A0315FFD5A53E457BEEEA56F8CD0F5F8B772829D8127E336CCA678C2B5987ED06989F894CAE111126A9EA5EE9BC5293C409C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d6461900-fb34-46fc-a9ce-24d8bd69132b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9448
Entropy (8bit):	5.835389884689632
Encrypted:	false
SSDEEP:	192:fsNwPaeiRUbI1vQ5r1vkKH96qRAq1k8SPxVLZ7VTiB:fsNw4SwY5JMKH96q3QxVNZTiB
MD5:	BDEC4AAA1C8C8B7E9FB96CA749D92426
SHA1:	B5DDD65F02C056BCCD3A9DAFDFB76FF9B9AB3B71
SHA-256:	028F5B71A6DB154A736CD4BD62444FFC6B22ECE48D42AB9AE2BA04900E1E647D
SHA-512:	829DF7553AFA00CEA0CC290448E6D5439A3BEE9A9EF651B0F26573CB480DA64501427FDFCC99E39C6133840B93CF614B751180A43D41B4560388A5E7208E6C3C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e8038df6-e6f4-4b81-bc3c-d290bdb8240e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.805167875941568
Encrypted:	false
SSDEEP:	192:fsNAPaeiRU2zQ3kKP6qRAq1k8SPxVLZ7VTiQ:fsNA4100KP6q3QxVNZTiQ
MD5:	BAE5BD08E12B2D797762F3D90B33B5D2
SHA1:	707FD1B94A43E8FDE27B42F9B57C2C8CC1A3D19E
SHA-256:	6D5205062D32F861F654976A275080FD1D69BB9614565046869E0E74B4267F9B
SHA-512:	2E50027602219D4EF5C32B65F3D6AA4089CA4FB1BA36BA4E85DA764204510B77E32B8CE939B247058881EA270449CDD74555BBBADCC46FAAAC670C0D99DF0E66
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\eeeae180-38d2-4170-ac53-58813eefca98.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24701
Entropy (8bit):	6.0522144341853625
Encrypted:	false
SSDEEP:	384:MtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaVsNxFOzj3azdizXH00jGX4KXs:MM7X2zt1jKYqHkZeMe0jEizXH034Kc
MD5:	AB30991DC5C593B1D9033B5367B5B899
SHA1:	B6304EC06FA56EA017310CE6CF36EC75CC8D5DB6
SHA-256:	AA249E66AEDD6C96E4F75854DBF4AF759F7EA9FBE4838EBDFFAE14FCE9E148A4
SHA-512:	DFDA4E08780CDB77DC74375A36ACC9B6A1F836B3F05A24C53228FF999162A1B987795D79562F42C380190B8EA363EF124739C9F56E28D80BCD1894660EBFB62D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369319410354439","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8601121245113514
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxUxl9Il8ubXoE4hOP1e/XrQFaJ5d1rc:m5YFBEO4/XEkJa
MD5:	909BE9375CE67FF8B707F3E3E122577E
SHA1:	18CB4BA09152C00063C1EC236DE758AC94908FDE
SHA-256:	D94AE8111C5BBC35BF8F9A97BC0942B09D5CFCA275B573662F094C267D44FDBE
SHA-512:	1887B4D673F944CAE6230D0777DF42855C9DFF93AA25545F2B5A6C027F5BC51FC45A5B7DABED9F2ACB237BE68AF2809F5CCC83FDA090749D27B4FE6FA1C0ED93
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.I.g.8.y.U.j.5.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.o.E.i.1.B.X.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000774828777844
Encrypted:	false
SSDEEP:	96:0NYlA7T4D/NY8piJrH2X2xrS+A73aZySFItOU:aeA7T4xY/JrxxZA7vQU
MD5:	262E798813110B59C03B453CE000A952
SHA1:	8DF64F6C289712B825C9F0936AAA6CF624CD581E
SHA-256:	3054C2489F02ED3A0815C6D0463526B8620A948D5FC8A91CC52ABAA707EBB6F4
SHA-512:	AB01B5FA8F3015562E325AD293627D1239D52C35E050C61F7E5D4C5C9E3F8BA9FEDA5F9094D02215DA89052C73F03F77F6BB2C54ADB0779210D1A5C43A9FFC88
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".y.+.U.Z.r.0.D.5.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.o.E.i.1.B.X.

C:\Users\user\AppData\Local\Temp\0f9d3a9c-82b8-40fd-ac7e-b5ed7aa48c0e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\7359e833-5c87-4ecf-b812-11ca7ed2496b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\79d6cd0a-2b2b-432a-81be-9b9b2eda3645.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cb77545f-082d-4277-84fe-e0b9b94086c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.400633041937343
Encrypted:	false
SSDEEP:	12:YWATW60Dkv/Ida/TG4GL56s/IdjFrx0Dkv/IQVt56s/C:YWo0jaSlL5gjFt0yVt5M
MD5:	63F9B9573039EE41811C651B91385021
SHA1:	71EA34F50973477198B3BCD93C2E1DE1DFEA019F
SHA-256:	2ACCEA98D9CFFCCE78DA4CBF97365652FE4130F3CEFF1FE0319721DBA3AA76E5
SHA-512:	FDA33F54194C585C361B10E68926A3E16523642890713273F44549BCAF30E00FD3DD827A7A78D6BE4EC7575AA5E87341CBC45592AB73E1E2F2DA796518F394DE
Malicious:	false
Preview:	{"logTime": "0828/114959", "correlationVector":"50C4544563A34594BB86B0E8096E2EE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0828/115011", "correlationVector":"qHqfuYVHj8jra6xcF7C+LP","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0828/115011", "correlationVector":"B5BF054E16E84922BAEBB4207B83D5C9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0828/115012", "correlationVector":"jHlsqcRllQWYhFvwfIMyZK","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\scoped_dir9212_1994444773\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir9212_1994444773\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9212_1994444773\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9212_1994444773\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_1994444773\cb77545f-082d-4277-84fe-e0b9b94086c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\0f9d3a9c-82b8-40fd-ac7e-b5ed7aa48c0e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir9212_692988677\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.508511846205711
Encrypted:	false
SSDEEP:	48:IEtvdOnHIMsJe/rwzBdLXuHOkDp62AQDG1dOnKIMsJe/rwzngdLXuHOk+21:LQU3uukDJJQUnIuukz
MD5:	0EF2C6A552E9F2282806C73C794287E2
SHA1:	B46D68BC90EDE5C64BB54432E8D5B50BADF46AAF
SHA-256:	741F1A8C8E48B554B7C5720A81DE5BC45549631A41A9B1B2359FC616F9D3E6DE
SHA-512:	359281CB7A78085A0353CE67D6D9E8F613866B15348032061D4B77E7AF993D74C5315504631AFC72982C2C7A918D0486AF1096A40BEE26B44FC5E75E18B35E2A
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...Us`h@....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V......@z.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y<^..........................Be..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y;^..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y;^....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............j9......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LPKM3QDH2KG6282EI5G4.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.504111454852921
Encrypted:	false
SSDEEP:	48:IEQDG1dOnKIMsJe/rwzBdLXuHOkDp62AQDG1dOnKIMsJe/rwzngdLXuHOk+21:sQU3uukDJJQUnIuukz
MD5:	D5A541DC1AB964AF2098F1DA7F8B039A
SHA1:	656B82D5E3A3A5D6076D2CB0C035CEBD11D1D480
SHA-256:	8883FC3D839B49D618B886E795F3D86D2C941FE89BAF645052D3A0D61F518C40
SHA-512:	0E59AE5FA7C566033DC6FAD8359C7717DFFBD56BF7929393F31EA3E10A5F0DA25C1B6FEFEF4936C110A744CE483D7B6925ED28D4791B08E36691C31BFC4C0D9C
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...Us`h@....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y9^..PROGRA~2.........O.I.Y9^....................V......l.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y<^..........................Be..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y@^...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y;^..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y;^....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............j9......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q1Z09KZVSH7H7R41RSS9.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.508511846205711
Encrypted:	false
SSDEEP:	48:IEtvdOnHIMsJe/rwzBdLXuHOkDp62AQDG1dOnKIMsJe/rwzngdLXuHOk+21:LQU3uukDJJQUnIuukz
MD5:	0EF2C6A552E9F2282806C73C794287E2
SHA1:	B46D68BC90EDE5C64BB54432E8D5B50BADF46AAF
SHA-256:	741F1A8C8E48B554B7C5720A81DE5BC45549631A41A9B1B2359FC616F9D3E6DE
SHA-512:	359281CB7A78085A0353CE67D6D9E8F613866B15348032061D4B77E7AF993D74C5315504631AFC72982C2C7A918D0486AF1096A40BEE26B44FC5E75E18B35E2A
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...Us`h@....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V......@z.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y<^..........................Be..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y;^..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y;^....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............j9......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.504111454852921
Encrypted:	false
SSDEEP:	48:IEQDG1dOnKIMsJe/rwzBdLXuHOkDp62AQDG1dOnKIMsJe/rwzngdLXuHOk+21:sQU3uukDJJQUnIuukz
MD5:	D5A541DC1AB964AF2098F1DA7F8B039A
SHA1:	656B82D5E3A3A5D6076D2CB0C035CEBD11D1D480
SHA-256:	8883FC3D839B49D618B886E795F3D86D2C941FE89BAF645052D3A0D61F518C40
SHA-512:	0E59AE5FA7C566033DC6FAD8359C7717DFFBD56BF7929393F31EA3E10A5F0DA25C1B6FEFEF4936C110A744CE483D7B6925ED28D4791B08E36691C31BFC4C0D9C
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...Us`h@....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y9^..PROGRA~2.........O.I.Y9^....................V......l.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y<^..........................Be..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y@^...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y;^..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y;^....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............j9......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5797753578123395
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	b5a6e633330ede88b76777532223017b
SHA1:	7f02397384b237520a6f91678be73d9c75f106e5
SHA256:	dd1074b75f93e632e7b78b5504fe07d4bcfcbc71759c779394c0efe5b572ce51
SHA512:	711ab625b4ead10abd29304eb22d650ed480abdce2f31505e8e8704d73cacdb74e3501484f51b12889f470b3454dc1934b6bc1cec0db504461019ba241703b88
SSDEEP:	12288:bqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTY:bqDEvCTbMWu7rQYlBQcBiT6rprG8asY
TLSH:	8A159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CF0E70 [Wed Aug 28 11:48:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FE7388E04E3h
jmp 00007FE7388DFDEFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FE7388DFFCDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FE7388DFF9Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FE7388E2B8Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FE7388E2BD8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FE7388E2BC1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	f5dbb79ff3e51344e81e30b516e5431e	False	0.28692708333333333	data	5.165954527317823	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 13:49:50.554982901 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 28, 2024 13:50:00.163263083 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 28, 2024 13:50:00.845674992 CEST	49747	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:00.845705032 CEST	443	49747	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:00.845798016 CEST	49747	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:00.845985889 CEST	49747	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:00.846002102 CEST	443	49747	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:00.880934000 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:00.880956888 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:00.881135941 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:00.881220102 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:00.881231070 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.415321112 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.415360928 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.415436983 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.415797949 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.415833950 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.415894985 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.416265965 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.416273117 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.416321993 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.416635036 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.416641951 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.416990995 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.418325901 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.418339014 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.418498993 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.418510914 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.418585062 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.418593884 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.418723106 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.418730974 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.496543884 CEST	443	49747	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.496953964 CEST	49747	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.496983051 CEST	443	49747	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.497983932 CEST	443	49747	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.498034954 CEST	49747	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.499222040 CEST	49747	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.499283075 CEST	443	49747	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.499480009 CEST	49747	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.499494076 CEST	443	49747	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.500339985 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.500374079 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.500469923 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.501142025 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.501152992 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.513659000 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.513833046 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.513844013 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.514849901 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.514899969 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.515242100 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.515299082 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.515511990 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.515518904 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.569660902 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.600215912 CEST	443	49747	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.600259066 CEST	443	49747	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.600276947 CEST	49747	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.600286007 CEST	443	49747	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.600300074 CEST	49747	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.600325108 CEST	49747	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.601733923 CEST	49747	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.601757050 CEST	443	49747	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.695753098 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.695771933 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.695777893 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.695791960 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.695799112 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.695804119 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.695815086 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.695837975 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.695854902 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.695878029 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.778994083 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.779022932 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.779056072 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.779087067 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.779103994 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.779129028 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.780544043 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.780559063 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.780611038 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.780618906 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.780658007 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.865634918 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.865652084 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.865689039 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.865715981 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.865753889 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.865775108 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.865777016 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.865792990 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.865824938 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.873451948 CEST	49748	443	192.168.2.4	13.107.246.42
Aug 28, 2024 13:50:01.873471022 CEST	443	49748	13.107.246.42	192.168.2.4
Aug 28, 2024 13:50:01.878679991 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.881136894 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.881140947 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.893121004 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.894145966 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.894156933 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.895370960 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.895463943 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.907202005 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.907215118 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.907409906 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.907426119 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.908428907 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.908437014 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.908500910 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.908654928 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.909385920 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.909394979 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.910459042 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.910537958 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.939531088 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.939637899 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.939694881 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.939821959 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.939841986 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.939917088 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.939956903 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.940049887 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.940466881 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.940485954 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.940517902 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.940534115 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.940589905 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:01.940589905 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.940602064 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:01.940614939 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.954056025 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.954364061 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.954375029 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.955378056 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.955436945 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.956763983 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.956820011 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.956964970 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:01.956969976 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:01.991638899 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:02.040669918 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:02.040776968 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:02.041770935 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:02.041805029 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:02.041861057 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:02.044145107 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:02.044194937 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:02.044199944 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:02.044851065 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:02.045196056 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:02.045209885 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:02.045563936 CEST	49751	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:02.045578003 CEST	443	49751	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:02.049103975 CEST	49752	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:02.049113035 CEST	443	49752	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:02.049307108 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:02.049310923 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:02.085315943 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:02.093116999 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:02.093178988 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:02.093244076 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:02.097794056 CEST	49755	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:02.097805977 CEST	443	49755	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:02.572974920 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:02.573033094 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:02.573232889 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:02.574927092 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:02.574945927 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:03.395152092 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:03.395241022 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:03.397892952 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:03.397907019 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:03.398118973 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:03.439693928 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:03.449285030 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:03.492507935 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:03.669070005 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:03.669131041 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:03.669255972 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:03.669287920 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:03.669306993 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:03.669320107 CEST	49759	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:03.669327974 CEST	443	49759	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:03.708340883 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:03.708383083 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:03.708456039 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:03.708760023 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:03.708770037 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:03.718149900 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.718175888 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.718317986 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.718324900 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.718353033 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.718381882 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.718528986 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.718542099 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.718636990 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.718648911 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.184861898 CEST	49763	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.184897900 CEST	443	49763	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.184966087 CEST	49763	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.185003042 CEST	49764	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.185026884 CEST	443	49764	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.185148001 CEST	49764	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.185303926 CEST	49763	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.185317993 CEST	443	49763	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.185551882 CEST	49764	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.185566902 CEST	443	49764	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.190839052 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.191205025 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:04.191220045 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.191561937 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.192151070 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:04.192217112 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.211458921 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.211667061 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:04.211677074 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.212023020 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.212667942 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:04.212735891 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.336628914 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:04.336873055 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:04.343952894 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:04.344017982 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:04.345226049 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:04.345238924 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:04.345443010 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:04.346523046 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:04.392501116 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:04.476855993 CEST	49765	443	192.168.2.4	142.251.40.132
Aug 28, 2024 13:50:04.476886988 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:04.476974010 CEST	49765	443	192.168.2.4	142.251.40.132
Aug 28, 2024 13:50:04.477484941 CEST	49765	443	192.168.2.4	142.251.40.132
Aug 28, 2024 13:50:04.477495909 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:04.621102095 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:04.621166945 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:04.621228933 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:04.622488022 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:04.622513056 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:04.622524977 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 28, 2024 13:50:04.622530937 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 28, 2024 13:50:04.662107944 CEST	443	49763	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.662587881 CEST	49763	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.662616014 CEST	443	49763	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.663023949 CEST	443	49763	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.663093090 CEST	49763	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.663778067 CEST	443	49763	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.663839102 CEST	49763	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.665410042 CEST	49763	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.665478945 CEST	443	49763	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.666309118 CEST	49763	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.666320086 CEST	443	49763	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.672897100 CEST	443	49764	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.673269033 CEST	49764	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.673297882 CEST	443	49764	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.673667908 CEST	443	49764	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.673733950 CEST	49764	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.674344063 CEST	443	49764	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.674381971 CEST	49764	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.674689054 CEST	49764	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.674741030 CEST	443	49764	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.675030947 CEST	49764	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.675039053 CEST	443	49764	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.712526083 CEST	49763	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.778377056 CEST	443	49763	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.778431892 CEST	443	49763	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.778549910 CEST	49763	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.787631035 CEST	49763	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.787646055 CEST	443	49763	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.791161060 CEST	443	49764	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.791285038 CEST	49764	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.791956902 CEST	49764	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:04.791975021 CEST	443	49764	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:04.938632965 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:04.938951969 CEST	49765	443	192.168.2.4	142.251.40.132
Aug 28, 2024 13:50:04.938966990 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:04.939980030 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:04.940041065 CEST	49765	443	192.168.2.4	142.251.40.132
Aug 28, 2024 13:50:04.941277981 CEST	49765	443	192.168.2.4	142.251.40.132
Aug 28, 2024 13:50:04.941335917 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:04.941586018 CEST	49765	443	192.168.2.4	142.251.40.132
Aug 28, 2024 13:50:04.941593885 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:05.036550045 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:05.036583900 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:05.036603928 CEST	49765	443	192.168.2.4	142.251.40.132
Aug 28, 2024 13:50:05.036617041 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:05.036693096 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:05.036744118 CEST	49765	443	192.168.2.4	142.251.40.132
Aug 28, 2024 13:50:05.036748886 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:05.036757946 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:05.036828041 CEST	49765	443	192.168.2.4	142.251.40.132
Aug 28, 2024 13:50:05.037802935 CEST	49765	443	192.168.2.4	142.251.40.132
Aug 28, 2024 13:50:05.037827969 CEST	443	49765	142.251.40.132	192.168.2.4
Aug 28, 2024 13:50:05.103203058 CEST	49766	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.103257895 CEST	443	49766	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.103403091 CEST	49767	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.103451967 CEST	49766	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.103457928 CEST	443	49767	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.103507996 CEST	49767	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.103693008 CEST	49766	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.103710890 CEST	443	49766	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.103809118 CEST	49767	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.103827000 CEST	443	49767	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.567737103 CEST	443	49766	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.568005085 CEST	49766	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.568037033 CEST	443	49766	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.568355083 CEST	443	49766	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.568409920 CEST	49766	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.568974972 CEST	443	49766	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.569031954 CEST	49766	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.569174051 CEST	49766	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.569226027 CEST	443	49766	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.594566107 CEST	443	49767	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.594763041 CEST	49767	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.594784975 CEST	443	49767	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.595148087 CEST	443	49767	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.595211029 CEST	49767	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.595892906 CEST	443	49767	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.595948935 CEST	49767	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.596102953 CEST	49767	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.596163034 CEST	443	49767	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.616595030 CEST	49766	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.616602898 CEST	443	49766	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.647841930 CEST	49767	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.647850990 CEST	443	49767	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.663470984 CEST	49766	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.694732904 CEST	49767	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:12.834755898 CEST	49772	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:12.834793091 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:12.834852934 CEST	49772	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:12.835966110 CEST	49772	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:12.835975885 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:12.893980026 CEST	49672	443	192.168.2.4	173.222.162.32
Aug 28, 2024 13:50:12.894026995 CEST	443	49672	173.222.162.32	192.168.2.4
Aug 28, 2024 13:50:13.624958038 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:13.625052929 CEST	49772	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:13.776340961 CEST	49772	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:13.776371002 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:13.776705027 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:13.821429014 CEST	49772	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:14.039814949 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 28, 2024 13:50:14.039894104 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.039969921 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 28, 2024 13:50:14.040633917 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:14.040649891 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:14.040699005 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:14.040891886 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 28, 2024 13:50:14.040927887 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.041001081 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:14.041013956 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:14.668832064 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.670845032 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 28, 2024 13:50:14.670857906 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.672116041 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.672180891 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 28, 2024 13:50:14.673374891 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 28, 2024 13:50:14.673434973 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.673552990 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 28, 2024 13:50:14.673561096 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.676523924 CEST	49772	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:14.724489927 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:14.757178068 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 28, 2024 13:50:14.759799957 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:14.760057926 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:14.760068893 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:14.760413885 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:14.760425091 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:14.760471106 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:14.760478973 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:14.760529995 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:14.761097908 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:14.762475967 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:14.762540102 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:14.762676954 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:14.762685061 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:14.770658970 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.770677090 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.770684004 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.770699978 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.770708084 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.770728111 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 28, 2024 13:50:14.770734072 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.770747900 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.770760059 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.770776987 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 28, 2024 13:50:14.770801067 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 28, 2024 13:50:14.771609068 CEST	49775	443	192.168.2.4	13.107.246.60
Aug 28, 2024 13:50:14.771616936 CEST	443	49775	13.107.246.60	192.168.2.4
Aug 28, 2024 13:50:14.935573101 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:14.935599089 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:14.935606003 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:14.935615063 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:14.935633898 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:14.935651064 CEST	49772	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:14.935672045 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:14.935686111 CEST	49772	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:14.935718060 CEST	49772	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:14.936423063 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:14.936485052 CEST	49772	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:14.936491013 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:14.936499119 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:14.936532021 CEST	49772	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:14.967497110 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.032779932 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.032813072 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.033206940 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.033217907 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.035629034 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.035676956 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.035684109 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.041902065 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.041981936 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.041990042 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.048242092 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.048297882 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.048305035 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.054702044 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.054764986 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.054773092 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.060851097 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.060914040 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.060921907 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.069751024 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.069809914 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.069818020 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.073899031 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.073951960 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.073960066 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.120832920 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.121078014 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.121084929 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.122386932 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.122462034 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.122468948 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.128535986 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.128583908 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.128595114 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.134675980 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.134723902 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.134731054 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.140991926 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.141063929 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.141072035 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.147387028 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.150003910 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.150011063 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.153620005 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.153736115 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.153743029 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.159903049 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.159949064 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.159957886 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.166189909 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.166240931 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.166248083 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.172110081 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.172149897 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.172157049 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.177561045 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.178813934 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.178822994 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.183100939 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.183149099 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.183156013 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.188452959 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.188505888 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.188513041 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.193922043 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.193968058 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.193974972 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.199505091 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.200645924 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.200651884 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.205600023 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.205651045 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.205657959 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.208723068 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.208764076 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.208770990 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.212704897 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.212759972 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.212766886 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.216278076 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.216321945 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.216329098 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.219983101 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.220027924 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.220033884 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.223431110 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.223467112 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.223474979 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.226924896 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.226973057 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.226979971 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.230391026 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.230437994 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.230444908 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.234044075 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.234086990 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.234093904 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.237384081 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.237426043 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.237437963 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.241528034 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.241606951 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.241614103 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.244725943 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.244770050 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.244776011 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.248073101 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.248117924 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.248125076 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.251744986 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.251796961 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.251806021 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.254823923 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.254868031 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.254873991 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.258517027 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.258574009 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.258580923 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.261905909 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.261951923 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.261960030 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.265366077 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.265413046 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.265419006 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.268942118 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.269051075 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.269057035 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.272809982 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.272866964 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.272872925 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.275968075 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.276014090 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.276021004 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.279357910 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.279402971 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.279409885 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.282663107 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.282707930 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.282715082 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.286034107 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.286077023 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.286083937 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.289256096 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.289280891 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.289303064 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.289310932 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.289652109 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.292208910 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.295228958 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.295272112 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.295279980 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.295401096 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.295593977 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.295742989 CEST	49777	443	192.168.2.4	142.250.184.225
Aug 28, 2024 13:50:15.295751095 CEST	443	49777	142.250.184.225	192.168.2.4
Aug 28, 2024 13:50:15.573673010 CEST	49772	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:15.573688984 CEST	443	49772	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:16.814646006 CEST	49783	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:16.814671040 CEST	443	49783	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:16.814735889 CEST	49783	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:16.815114975 CEST	49784	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:16.815124989 CEST	443	49784	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:16.815347910 CEST	49784	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:16.815377951 CEST	49783	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:16.815392017 CEST	443	49783	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:16.815574884 CEST	49784	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:16.815586090 CEST	443	49784	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:16.867281914 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:16.867315054 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:16.867377996 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:16.868030071 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:16.868057013 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:17.268675089 CEST	443	49784	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.269040108 CEST	49784	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.269068956 CEST	443	49784	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.270072937 CEST	443	49784	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.270138025 CEST	49784	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.271183014 CEST	49784	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.271250963 CEST	443	49784	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.271414995 CEST	49784	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.271431923 CEST	443	49784	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.277226925 CEST	443	49783	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.277460098 CEST	49783	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.277476072 CEST	443	49783	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.278450966 CEST	443	49783	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.278516054 CEST	49783	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.279576063 CEST	49783	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.279635906 CEST	443	49783	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.279715061 CEST	49783	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.320286036 CEST	49783	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.320293903 CEST	443	49783	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.340220928 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:17.340523005 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:17.340529919 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:17.341485023 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:17.341550112 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:17.342417955 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:17.342477083 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:17.342602015 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:17.342607975 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:17.367307901 CEST	49783	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.382606030 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:17.391258955 CEST	443	49784	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.391316891 CEST	49784	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.391504049 CEST	49784	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.391510963 CEST	443	49784	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.408355951 CEST	443	49783	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.408407927 CEST	443	49783	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.408519030 CEST	49783	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.408607960 CEST	49783	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:17.408612967 CEST	443	49783	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:17.473141909 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:17.473198891 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:17.473318100 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:17.474024057 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:17.474028111 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:19.097501993 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:19.097579956 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:19.097678900 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:19.116127968 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:19.116202116 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:19.116389990 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:32.526169062 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:32.526209116 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:32.526268005 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:32.526406050 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:32.526442051 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:32.526612043 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:32.526649952 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:32.526663065 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:32.526752949 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:32.526768923 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:32.981594086 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:32.982388973 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:32.982409000 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:32.982728958 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:32.985620975 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:32.985687971 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:32.992217064 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.012327909 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:33.012343884 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.012700081 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.019222021 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:33.019288063 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.038305998 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:33.069550037 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:33.111613035 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 28, 2024 13:50:33.111630917 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 28, 2024 13:50:33.111696959 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 28, 2024 13:50:33.111918926 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 28, 2024 13:50:33.111927032 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 28, 2024 13:50:33.691716909 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 28, 2024 13:50:33.691973925 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 28, 2024 13:50:33.691989899 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 28, 2024 13:50:33.693041086 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 28, 2024 13:50:33.693099976 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 28, 2024 13:50:33.694386005 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 28, 2024 13:50:33.694448948 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 28, 2024 13:50:33.694602966 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 28, 2024 13:50:33.694611073 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 28, 2024 13:50:33.741902113 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 28, 2024 13:50:33.794859886 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 28, 2024 13:50:33.795603037 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 28, 2024 13:50:33.795609951 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 28, 2024 13:50:33.795639038 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 28, 2024 13:50:33.795653105 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 28, 2024 13:50:33.795674086 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 28, 2024 13:50:33.795711994 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 28, 2024 13:50:33.796221972 CEST	49789	443	192.168.2.4	152.195.19.97
Aug 28, 2024 13:50:33.796231985 CEST	443	49789	152.195.19.97	192.168.2.4
Aug 28, 2024 13:50:34.091268063 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.091285944 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.091430902 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.091577053 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.091578960 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.091589928 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.091614008 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.091789007 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.091789007 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.091825008 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.546091080 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.546324968 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.546341896 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.546675920 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.546981096 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.547043085 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.580868959 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.581351042 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.581362963 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.581688881 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.583194971 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.583259106 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.600692034 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.631865025 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:47.892596960 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:47.892673969 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:47.892730951 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:47.901118040 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:47.901181936 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:47.901240110 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:49.456047058 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:49.456119061 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:49.456161022 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:49.479542017 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:49.479629040 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:49.479677916 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:50.631783962 CEST	49766	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:50.631803036 CEST	443	49766	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:50.663039923 CEST	49767	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:50.663054943 CEST	443	49767	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:52.642035961 CEST	49794	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:52.642064095 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:52.642139912 CEST	49794	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:52.642517090 CEST	49794	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:52.642530918 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.430761099 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.430937052 CEST	49794	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:53.434485912 CEST	49794	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:53.434511900 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.434752941 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.442693949 CEST	49794	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:53.488492966 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.755790949 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.755809069 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.755821943 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.755887032 CEST	49794	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:53.755899906 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.755947113 CEST	49794	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:53.757631063 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.757667065 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.757694960 CEST	49794	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:53.757700920 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.757716894 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.757725000 CEST	49794	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:53.757762909 CEST	49794	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:53.761265039 CEST	49794	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:53.761272907 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:53.761284113 CEST	49794	443	192.168.2.4	40.127.169.103
Aug 28, 2024 13:50:53.761286974 CEST	443	49794	40.127.169.103	192.168.2.4
Aug 28, 2024 13:50:56.246011972 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.246047020 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.246103048 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.246376038 CEST	49796	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.246406078 CEST	443	49796	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.246462107 CEST	49796	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.246644020 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.246654987 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.246783018 CEST	49796	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.246794939 CEST	443	49796	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.699568987 CEST	443	49796	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.699814081 CEST	49796	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.699841976 CEST	443	49796	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.700166941 CEST	443	49796	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.700440884 CEST	49796	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.700520992 CEST	443	49796	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.710246086 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.710417986 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.710434914 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.710761070 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.711020947 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.711083889 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.741941929 CEST	49796	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.757566929 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:51:04.100800991 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:04.100825071 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:04.132055998 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:04.132064104 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:07.929862976 CEST	49723	80	192.168.2.4	88.221.110.91
Aug 28, 2024 13:51:07.930027962 CEST	49724	80	192.168.2.4	199.232.210.172
Aug 28, 2024 13:51:07.935168982 CEST	80	49723	88.221.110.91	192.168.2.4
Aug 28, 2024 13:51:07.935272932 CEST	49723	80	192.168.2.4	88.221.110.91
Aug 28, 2024 13:51:07.935519934 CEST	80	49724	199.232.210.172	192.168.2.4
Aug 28, 2024 13:51:07.935590029 CEST	49724	80	192.168.2.4	199.232.210.172
Aug 28, 2024 13:51:11.559906006 CEST	49791	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:51:11.559930086 CEST	443	49791	172.64.41.3	192.168.2.4
Aug 28, 2024 13:51:11.559950113 CEST	49790	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:51:11.559981108 CEST	443	49790	172.64.41.3	192.168.2.4
Aug 28, 2024 13:51:11.611336946 CEST	443	49796	172.64.41.3	192.168.2.4
Aug 28, 2024 13:51:11.611399889 CEST	443	49796	172.64.41.3	192.168.2.4
Aug 28, 2024 13:51:11.611443996 CEST	49796	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:51:11.618766069 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 28, 2024 13:51:11.618824959 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 28, 2024 13:51:11.618870020 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:51:32.898535967 CEST	49788	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:51:32.898555040 CEST	443	49788	172.64.41.3	192.168.2.4
Aug 28, 2024 13:51:32.914155960 CEST	49787	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:51:32.914180994 CEST	443	49787	172.64.41.3	192.168.2.4
Aug 28, 2024 13:51:35.633066893 CEST	49766	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:51:35.633088112 CEST	443	49766	142.251.35.174	192.168.2.4
Aug 28, 2024 13:51:35.664227962 CEST	49767	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:51:35.664247990 CEST	443	49767	142.251.35.174	192.168.2.4
Aug 28, 2024 13:51:49.101530075 CEST	49761	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:49.101556063 CEST	443	49761	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:49.132770061 CEST	49762	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:49.132776976 CEST	443	49762	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:56.617211103 CEST	49796	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:51:56.617238998 CEST	443	49796	172.64.41.3	192.168.2.4
Aug 28, 2024 13:51:56.632793903 CEST	49795	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:51:56.632822037 CEST	443	49795	172.64.41.3	192.168.2.4
Aug 28, 2024 13:51:58.927110910 CEST	49800	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:58.927154064 CEST	443	49800	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:58.927217007 CEST	49800	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:58.927268982 CEST	49801	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:58.927304029 CEST	443	49801	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:58.927351952 CEST	49801	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:58.927460909 CEST	49800	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:58.927474976 CEST	443	49800	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:58.927572966 CEST	49801	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:58.927587032 CEST	443	49801	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.394804955 CEST	443	49801	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.395832062 CEST	49801	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.395847082 CEST	443	49801	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.396218061 CEST	443	49801	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.396307945 CEST	443	49800	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.396478891 CEST	49801	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.396554947 CEST	443	49801	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.396672964 CEST	49800	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.396688938 CEST	443	49800	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.397000074 CEST	443	49800	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.397736073 CEST	49800	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.397794008 CEST	443	49800	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.445600033 CEST	49800	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.445600986 CEST	49801	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.496334076 CEST	49802	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:51:59.496376038 CEST	443	49802	23.200.0.9	192.168.2.4
Aug 28, 2024 13:51:59.496459961 CEST	49802	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:51:59.496653080 CEST	49802	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:51:59.496665955 CEST	443	49802	23.200.0.9	192.168.2.4
Aug 28, 2024 13:51:59.968015909 CEST	443	49802	23.200.0.9	192.168.2.4
Aug 28, 2024 13:51:59.968488932 CEST	49802	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:51:59.968512058 CEST	443	49802	23.200.0.9	192.168.2.4
Aug 28, 2024 13:51:59.968838930 CEST	443	49802	23.200.0.9	192.168.2.4
Aug 28, 2024 13:51:59.969152927 CEST	49802	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:51:59.969207048 CEST	443	49802	23.200.0.9	192.168.2.4
Aug 28, 2024 13:51:59.969289064 CEST	49802	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:52:00.012507915 CEST	443	49802	23.200.0.9	192.168.2.4
Aug 28, 2024 13:52:01.027020931 CEST	443	49802	23.200.0.9	192.168.2.4
Aug 28, 2024 13:52:01.027093887 CEST	443	49802	23.200.0.9	192.168.2.4
Aug 28, 2024 13:52:01.027153015 CEST	49802	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:52:01.027396917 CEST	49802	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:52:01.027415991 CEST	443	49802	23.200.0.9	192.168.2.4
Aug 28, 2024 13:52:01.027890921 CEST	49803	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:52:01.027928114 CEST	443	49803	23.200.0.9	192.168.2.4
Aug 28, 2024 13:52:01.027990103 CEST	49803	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:52:01.028147936 CEST	49803	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:52:01.028162003 CEST	443	49803	23.200.0.9	192.168.2.4
Aug 28, 2024 13:52:01.494415045 CEST	443	49803	23.200.0.9	192.168.2.4
Aug 28, 2024 13:52:01.495553017 CEST	49803	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:52:01.495572090 CEST	443	49803	23.200.0.9	192.168.2.4
Aug 28, 2024 13:52:01.495912075 CEST	443	49803	23.200.0.9	192.168.2.4
Aug 28, 2024 13:52:01.498600006 CEST	49803	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:52:01.498671055 CEST	443	49803	23.200.0.9	192.168.2.4
Aug 28, 2024 13:52:01.498754978 CEST	49803	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:52:01.544498920 CEST	443	49803	23.200.0.9	192.168.2.4
Aug 28, 2024 13:52:01.708619118 CEST	443	49803	23.200.0.9	192.168.2.4
Aug 28, 2024 13:52:01.708904982 CEST	49803	443	192.168.2.4	23.200.0.9
Aug 28, 2024 13:52:01.708923101 CEST	443	49803	23.200.0.9	192.168.2.4
Aug 28, 2024 13:52:01.708971024 CEST	49803	443	192.168.2.4	23.200.0.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 13:49:57.625355959 CEST	53	53283	1.1.1.1	192.168.2.4
Aug 28, 2024 13:49:58.896716118 CEST	55396	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:49:58.896964073 CEST	52046	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:49:59.795418978 CEST	53	51413	1.1.1.1	192.168.2.4
Aug 28, 2024 13:49:59.984915018 CEST	53	53643	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:01.369498968 CEST	51706	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:01.369649887 CEST	58775	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:01.370018005 CEST	49263	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:01.370167017 CEST	58138	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:01.370512009 CEST	55968	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:01.370873928 CEST	53270	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:01.371958017 CEST	54175	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:01.372092009 CEST	50896	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:01.376262903 CEST	53	51706	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:01.376272917 CEST	53	58775	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:01.376804113 CEST	53	49263	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:01.377180099 CEST	53	55968	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:01.377728939 CEST	53	58138	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:01.378597021 CEST	53	54175	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:01.378791094 CEST	53	53270	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:01.378865957 CEST	53	50896	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:01.489733934 CEST	58749	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:01.490266085 CEST	52272	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:01.497853994 CEST	53	52272	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:01.499602079 CEST	53	58749	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:03.410931110 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.717678070 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.860902071 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.860975027 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.861303091 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.861315012 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.861326933 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.861445904 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.866712093 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.867041111 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.867209911 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.867304087 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.963324070 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.963651896 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.963663101 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.963671923 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.963802099 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.963876009 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:03.964198112 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.964732885 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:03.965039015 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:04.057554960 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.083220005 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:04.083328962 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:04.181323051 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.182182074 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.182585955 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.184367895 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:04.378072977 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:04.378170013 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:04.473449945 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.475146055 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.475725889 CEST	443	49589	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:04.476201057 CEST	49589	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:04.790328979 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.102839947 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.236901045 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.237380981 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.242750883 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.242793083 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.242805958 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.242847919 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.245337009 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.245394945 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.245892048 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.246753931 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.246867895 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.247242928 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.247252941 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.247423887 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.341902971 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.341918945 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.342181921 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.342360020 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.342813969 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.342955112 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.356817961 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.357106924 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.358896971 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.364275932 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.364381075 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:05.364609957 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.391963959 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:05.460113049 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:12.886871099 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:12.886923075 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:12.982634068 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:13.018979073 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:13.028747082 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:13.028954029 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:13.029592037 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:13.057566881 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:13.148931026 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:13.851898909 CEST	50313	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:13.852055073 CEST	61320	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:14.039150953 CEST	53	61320	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:14.039160967 CEST	53	50313	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:16.805509090 CEST	53595	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:16.805903912 CEST	56319	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:16.806406975 CEST	50731	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:16.806610107 CEST	54352	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:16.812144041 CEST	53	53595	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:16.812566996 CEST	53	56319	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:16.813272953 CEST	53	54352	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:16.813282967 CEST	53	50731	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:16.837310076 CEST	53	65104	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:16.859522104 CEST	62812	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:16.859898090 CEST	59309	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:50:16.866566896 CEST	53	62812	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:16.866638899 CEST	53	59309	1.1.1.1	192.168.2.4
Aug 28, 2024 13:50:19.503091097 CEST	138	138	192.168.2.4	192.168.2.255
Aug 28, 2024 13:50:32.525893927 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:32.849256992 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:32.973398924 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:32.973417997 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:32.973496914 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:32.973562002 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:32.973573923 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:32.979357958 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:32.985358953 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:33.003030062 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:33.006211042 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:33.009254932 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:33.012723923 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:33.015846968 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:33.100521088 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.100548029 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.100555897 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.100563049 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.100950003 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:33.101085901 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:33.103095055 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.107357979 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.109311104 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.109982967 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.111032963 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.111191034 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:33.195055008 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:33.225893021 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.089199066 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.090831995 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.090831995 CEST	55958	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.167558908 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:34.167645931 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:34.186542988 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.186877012 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.187501907 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.187802076 CEST	443	50225	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.191030979 CEST	50225	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.265069962 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:34.278409958 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:34.278419971 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:34.278876066 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:34.303886890 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:34.384063959 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:34.384134054 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:34.397614002 CEST	55958	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.400383949 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:34.479336023 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:34.492551088 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:34.492760897 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:34.492789030 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:34.522867918 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:34.534208059 CEST	443	55958	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.534260988 CEST	443	55958	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.534313917 CEST	443	55958	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.534359932 CEST	443	55958	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.534600973 CEST	55958	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.536349058 CEST	55958	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.536349058 CEST	55958	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.536609888 CEST	55958	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.536693096 CEST	55958	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.612749100 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:34.630819082 CEST	443	55958	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.630829096 CEST	443	55958	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.631145000 CEST	443	55958	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.631155014 CEST	443	55958	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.631388903 CEST	55958	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.631388903 CEST	55958	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.631653070 CEST	443	55958	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.631932020 CEST	443	55958	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.635147095 CEST	55958	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:34.724812984 CEST	443	55958	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:34.756983995 CEST	55958	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:35.184362888 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:35.292910099 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:35.292975903 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:35.295119047 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:35.356247902 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:35.415494919 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:35.441215038 CEST	443	64606	142.251.35.174	192.168.2.4
Aug 28, 2024 13:50:35.457492113 CEST	64606	443	192.168.2.4	142.251.35.174
Aug 28, 2024 13:50:35.666277885 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:35.666428089 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:35.666755915 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:35.666862011 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:36.054321051 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:36.116591930 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:36.117214918 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:36.148139000 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:36.148649931 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:36.148659945 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:36.148668051 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:36.148675919 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:36.148905993 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:36.149106026 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:36.210784912 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:36.242341042 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:36.242552996 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:36.242805004 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:36.337109089 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:36.337935925 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:36.338012934 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:50:36.338210106 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:50:36.339334965 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:50:36.339545012 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:50:36.788566113 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:50:36.788579941 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:50:36.788590908 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:50:36.788604021 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:50:36.788631916 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:50:36.789436102 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:50:36.789980888 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:50:36.790474892 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:50:36.889823914 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:50:36.889839888 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:50:36.889849901 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:50:36.890084982 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:50:36.929420948 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:50:36.969129086 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:50:36.969379902 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:50:36.969654083 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:50:36.970293999 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:50:36.971272945 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:50:37.093697071 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:50:56.245750904 CEST	60772	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.554635048 CEST	60772	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.693798065 CEST	443	60772	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.694674015 CEST	443	60772	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.695108891 CEST	443	60772	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.695153952 CEST	443	60772	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.695164919 CEST	443	60772	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.695425034 CEST	60772	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.695478916 CEST	60772	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.697267056 CEST	60772	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.697375059 CEST	60772	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.697582960 CEST	60772	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.697705030 CEST	60772	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.796581984 CEST	443	60772	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.796592951 CEST	443	60772	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.796601057 CEST	443	60772	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.796605110 CEST	443	60772	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.796964884 CEST	60772	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.797023058 CEST	60772	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.797754049 CEST	443	60772	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.798654079 CEST	443	60772	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.798666954 CEST	443	60772	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.798902988 CEST	60772	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:50:56.898282051 CEST	443	60772	172.64.41.3	192.168.2.4
Aug 28, 2024 13:50:56.929574013 CEST	60772	443	192.168.2.4	172.64.41.3
Aug 28, 2024 13:51:04.827400923 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:04.931056023 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:04.931540012 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:04.960114956 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:05.026216030 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:05.027136087 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:05.027237892 CEST	443	52254	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:05.027493954 CEST	52254	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:05.028386116 CEST	59119	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:05.028495073 CEST	59119	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:05.366614103 CEST	59119	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:05.472587109 CEST	443	59119	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:05.479810953 CEST	443	59119	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:05.479906082 CEST	443	59119	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:05.481065035 CEST	59119	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:05.481219053 CEST	59119	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:05.481618881 CEST	59119	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:05.481646061 CEST	59119	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:05.481755018 CEST	59119	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:05.680260897 CEST	443	59119	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:05.771502972 CEST	443	59119	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:05.772032022 CEST	443	59119	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:05.772218943 CEST	59119	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:05.772545099 CEST	443	59119	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:05.773083925 CEST	443	59119	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:05.799989939 CEST	443	59119	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:05.800251007 CEST	59119	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:05.800565004 CEST	443	59119	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:05.801187038 CEST	443	59119	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:05.801877022 CEST	443	59119	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:05.801922083 CEST	59119	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:05.836464882 CEST	59119	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:05.885248899 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:51:05.896395922 CEST	443	59119	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:05.984473944 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:51:05.984782934 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:51:06.009676933 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:51:06.009944916 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:51:06.108696938 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:51:06.147890091 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:51:06.148621082 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:51:06.148669958 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:51:06.148679018 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:51:06.148984909 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:51:06.149055004 CEST	61723	443	192.168.2.4	142.251.111.84
Aug 28, 2024 13:51:06.273371935 CEST	443	61723	142.251.111.84	192.168.2.4
Aug 28, 2024 13:51:35.415395021 CEST	52494	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:35.415528059 CEST	52494	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:35.952564955 CEST	443	52494	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:35.952749014 CEST	443	52494	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:35.952759027 CEST	443	52494	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:35.973200083 CEST	52494	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:35.973265886 CEST	52494	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:35.973601103 CEST	52494	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:35.973622084 CEST	52494	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:36.067951918 CEST	443	52494	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:36.069118977 CEST	443	52494	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:36.069128036 CEST	443	52494	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:36.096791983 CEST	443	52494	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:36.097397089 CEST	443	52494	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:36.114437103 CEST	52494	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:36.117558956 CEST	52494	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:36.156372070 CEST	52494	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:36.235959053 CEST	443	52494	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:37.364661932 CEST	52494	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:37.364700079 CEST	52494	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:37.493977070 CEST	443	52494	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:37.524399042 CEST	52494	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:37.547889948 CEST	443	52494	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:37.548140049 CEST	52494	443	192.168.2.4	172.217.165.142
Aug 28, 2024 13:51:37.667721987 CEST	443	52494	172.217.165.142	192.168.2.4
Aug 28, 2024 13:51:58.917059898 CEST	51414	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:51:58.917185068 CEST	54986	53	192.168.2.4	1.1.1.1
Aug 28, 2024 13:51:58.924026012 CEST	53	54986	1.1.1.1	192.168.2.4
Aug 28, 2024 13:51:58.924335003 CEST	53	51414	1.1.1.1	192.168.2.4
Aug 28, 2024 13:51:58.926476955 CEST	63352	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.242773056 CEST	63352	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.394742012 CEST	443	63352	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.394892931 CEST	443	63352	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.394905090 CEST	443	63352	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.394920111 CEST	443	63352	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.395298958 CEST	63352	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.397267103 CEST	63352	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.397393942 CEST	63352	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.397913933 CEST	63352	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.398025990 CEST	63352	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.492876053 CEST	443	63352	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.492888927 CEST	443	63352	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.492897034 CEST	443	63352	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.492901087 CEST	443	63352	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.493261099 CEST	63352	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.493361950 CEST	63352	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.494232893 CEST	443	63352	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.495446920 CEST	443	63352	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.495795965 CEST	443	63352	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.495922089 CEST	63352	443	192.168.2.4	162.159.61.3
Aug 28, 2024 13:51:59.588291883 CEST	443	63352	162.159.61.3	192.168.2.4
Aug 28, 2024 13:51:59.617571115 CEST	63352	443	192.168.2.4	162.159.61.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 28, 2024 13:50:00.845443964 CEST	192.168.2.4	1.1.1.1	c2b9	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 28, 2024 13:49:58.896716118 CEST	192.168.2.4	1.1.1.1	0x92c3	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:49:58.896964073 CEST	192.168.2.4	1.1.1.1	0x9bff	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Aug 28, 2024 13:50:01.369498968 CEST	192.168.2.4	1.1.1.1	0xec8b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.369649887 CEST	192.168.2.4	1.1.1.1	0x115e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 13:50:01.370018005 CEST	192.168.2.4	1.1.1.1	0xbf5a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.370167017 CEST	192.168.2.4	1.1.1.1	0x8398	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 13:50:01.370512009 CEST	192.168.2.4	1.1.1.1	0x8a03	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.370873928 CEST	192.168.2.4	1.1.1.1	0x20de	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 13:50:01.371958017 CEST	192.168.2.4	1.1.1.1	0x4969	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.372092009 CEST	192.168.2.4	1.1.1.1	0xaade	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 13:50:01.489733934 CEST	192.168.2.4	1.1.1.1	0x8db1	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.490266085 CEST	192.168.2.4	1.1.1.1	0xf085	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 13:50:13.851898909 CEST	192.168.2.4	1.1.1.1	0x514e	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:13.852055073 CEST	192.168.2.4	1.1.1.1	0x5dcf	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Aug 28, 2024 13:50:16.805509090 CEST	192.168.2.4	1.1.1.1	0x69bf	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:16.805903912 CEST	192.168.2.4	1.1.1.1	0xb05e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 13:50:16.806406975 CEST	192.168.2.4	1.1.1.1	0x1550	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:16.806610107 CEST	192.168.2.4	1.1.1.1	0xb50a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 13:50:16.859522104 CEST	192.168.2.4	1.1.1.1	0x68a1	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:16.859898090 CEST	192.168.2.4	1.1.1.1	0x7f12	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 13:51:58.917059898 CEST	192.168.2.4	1.1.1.1	0x2d41	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:51:58.917185068 CEST	192.168.2.4	1.1.1.1	0x27ab	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 28, 2024 13:49:58.904851913 CEST	1.1.1.1	192.168.2.4	0x9bff	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:49:58.904942036 CEST	1.1.1.1	192.168.2.4	0x92c3	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:00.838711023 CEST	1.1.1.1	192.168.2.4	0xa9f7	No error (0)	shed.dual-low.s-part-0014.t-0009.t-msedge.net	s-part-0014.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:00.838711023 CEST	1.1.1.1	192.168.2.4	0xa9f7	No error (0)	s-part-0014.t-0009.t-msedge.net		13.107.246.42	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.376262903 CEST	1.1.1.1	192.168.2.4	0xec8b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.376262903 CEST	1.1.1.1	192.168.2.4	0xec8b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.376272917 CEST	1.1.1.1	192.168.2.4	0x115e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 13:50:01.376804113 CEST	1.1.1.1	192.168.2.4	0xbf5a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.376804113 CEST	1.1.1.1	192.168.2.4	0xbf5a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.377180099 CEST	1.1.1.1	192.168.2.4	0x8a03	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.377180099 CEST	1.1.1.1	192.168.2.4	0x8a03	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.377728939 CEST	1.1.1.1	192.168.2.4	0x8398	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 13:50:01.378597021 CEST	1.1.1.1	192.168.2.4	0x4969	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.378597021 CEST	1.1.1.1	192.168.2.4	0x4969	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.378791094 CEST	1.1.1.1	192.168.2.4	0x20de	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 13:50:01.378865957 CEST	1.1.1.1	192.168.2.4	0xaade	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 13:50:01.497853994 CEST	1.1.1.1	192.168.2.4	0xf085	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 13:50:01.499602079 CEST	1.1.1.1	192.168.2.4	0x8db1	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:01.499602079 CEST	1.1.1.1	192.168.2.4	0x8db1	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:14.038695097 CEST	1.1.1.1	192.168.2.4	0xfc39	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:14.038695097 CEST	1.1.1.1	192.168.2.4	0xfc39	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:14.039150953 CEST	1.1.1.1	192.168.2.4	0x5dcf	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:14.039160967 CEST	1.1.1.1	192.168.2.4	0x514e	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:14.039160967 CEST	1.1.1.1	192.168.2.4	0x514e	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.225	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:15.317290068 CEST	1.1.1.1	192.168.2.4	0x7ebb	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:15.317290068 CEST	1.1.1.1	192.168.2.4	0x7ebb	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:15.317403078 CEST	1.1.1.1	192.168.2.4	0x3113	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:16.334103107 CEST	1.1.1.1	192.168.2.4	0x97be	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:16.335062027 CEST	1.1.1.1	192.168.2.4	0x36ab	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:16.335062027 CEST	1.1.1.1	192.168.2.4	0x36ab	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:16.812144041 CEST	1.1.1.1	192.168.2.4	0x69bf	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:16.812144041 CEST	1.1.1.1	192.168.2.4	0x69bf	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:16.812566996 CEST	1.1.1.1	192.168.2.4	0xb05e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 13:50:16.813272953 CEST	1.1.1.1	192.168.2.4	0xb50a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 13:50:16.813282967 CEST	1.1.1.1	192.168.2.4	0x1550	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:16.813282967 CEST	1.1.1.1	192.168.2.4	0x1550	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:16.866566896 CEST	1.1.1.1	192.168.2.4	0x68a1	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:16.866566896 CEST	1.1.1.1	192.168.2.4	0x68a1	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:16.866638899 CEST	1.1.1.1	192.168.2.4	0x7f12	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 13:50:18.373554945 CEST	1.1.1.1	192.168.2.4	0x3a41	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:18.373554945 CEST	1.1.1.1	192.168.2.4	0x3a41	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:19.376388073 CEST	1.1.1.1	192.168.2.4	0x3a41	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:19.376388073 CEST	1.1.1.1	192.168.2.4	0x3a41	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:20.388557911 CEST	1.1.1.1	192.168.2.4	0x3a41	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:20.388557911 CEST	1.1.1.1	192.168.2.4	0x3a41	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:22.391207933 CEST	1.1.1.1	192.168.2.4	0x3a41	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:22.391207933 CEST	1.1.1.1	192.168.2.4	0x3a41	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:50:26.394239902 CEST	1.1.1.1	192.168.2.4	0x3a41	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 13:50:26.394239902 CEST	1.1.1.1	192.168.2.4	0x3a41	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:51:58.924026012 CEST	1.1.1.1	192.168.2.4	0x27ab	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 13:51:58.924335003 CEST	1.1.1.1	192.168.2.4	0x2d41	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 13:51:58.924335003 CEST	1.1.1.1	192.168.2.4	0x2d41	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

slscr.update.microsoft.com

clients2.googleusercontent.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

bzib.nelreports.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49747	13.107.246.42	443	7980	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:01 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-28 11:50:01 UTC	559	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 11:50:01 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240828T115001Z-15c77d89844jhl6gb132cscd340000000g7000000000b50s Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-28 11:50:01 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49748	13.107.246.42	443	7980	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:01 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-28 11:50:01 UTC	583	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 11:50:01 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240828T115001Z-15c77d89844vht6zmafxh7wdkg0000000mt000000000huc8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-28 11:50:01 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-08-28 11:50:01 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-08-28 11:50:01 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-08-28 11:50:01 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-08-28 11:50:01 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49749	172.64.41.3	443	7980	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:01 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-28 11:50:01 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-28 11:50:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 28 Aug 2024 11:50:01 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ba414d678eb43a6-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 11:50:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fe 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49752	172.64.41.3	443	7980	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:01 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-28 11:50:01 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-28 11:50:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 28 Aug 2024 11:50:01 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ba414d67aa518c0-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 11:50:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 07 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49751	172.64.41.3	443	7980	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:01 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-28 11:50:01 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-28 11:50:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 28 Aug 2024 11:50:01 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ba414d67a364315-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 11:50:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a5 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49750	162.159.61.3	443	7980	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:01 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-28 11:50:01 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-28 11:50:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 28 Aug 2024 11:50:01 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ba414d67fad8c81-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 11:50:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49755	162.159.61.3	443	7980	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:01 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-28 11:50:01 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-28 11:50:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 28 Aug 2024 11:50:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ba414d6ce884326-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 11:50:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 7b 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom{#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49759	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:03 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-28 11:50:03 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=251154 Date: Wed, 28 Aug 2024 11:50:03 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49760	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:04 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-28 11:50:04 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=251162 Date: Wed, 28 Aug 2024 11:50:04 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-28 11:50:04 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49763	142.251.35.174	443	7980	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:04 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-28 11:50:04 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 28 Aug 2024 11:50:04 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49764	142.251.35.174	443	7980	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:04 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-28 11:50:04 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 28 Aug 2024 11:50:04 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49765	142.251.40.132	443	7980	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:04 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-28 11:50:05 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 28 Aug 2024 11:44:18 GMT Expires: Thu, 05 Sep 2024 11:44:18 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 346 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-28 11:50:05 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-08-28 11:50:05 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-08-28 11:50:05 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-08-28 11:50:05 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-08-28 11:50:05 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49775	13.107.246.60	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:14 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-28 11:50:14 UTC	559	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 11:50:14 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240828T115014Z-15c77d89844j2tjq56kca6f6zs0000000gvg00000000h223 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-28 11:50:14 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49772	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=nlpFYkMm1BY8RD1&MD=h25S4Nal HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-28 11:50:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 66bd6c63-35db-426c-90a0-3b93a37d9afe MS-RequestId: 5674d719-8d5d-4495-9352-9bb9859277cd MS-CV: cnu1cskvw0uluRJp.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 28 Aug 2024 11:50:14 GMT Connection: close Content-Length: 24490
2024-08-28 11:50:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-28 11:50:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49777	142.250.184.225	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:14 UTC	594	OUT	GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-28 11:50:15 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AHxI1nOuKekGWvHppB2Ipaza0yyHOuZwGHGszbP2J16xrdsKhk6H0EWy_t7Bgliz8YMFH_JtluZrqgrHeg X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Tue, 27 Aug 2024 14:27:46 GMT Expires: Wed, 27 Aug 2025 14:27:46 GMT Cache-Control: public, max-age=31536000 Age: 76948 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-28 11:50:15 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-08-28 11:50:15 UTC	1390	IN	Data Raw: fd c7 0f 59 dd ca cf cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d Data Ascii: Y0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>
2024-08-28 11:50:15 UTC	1390	IN	Data Raw: b0 78 c3 9a 50 64 5d fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad Data Ascii: xPd]DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewW
2024-08-28 11:50:15 UTC	1390	IN	Data Raw: d9 73 4a e4 91 70 9d a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d Data Ascii: sJp:fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~
2024-08-28 11:50:15 UTC	1390	IN	Data Raw: 58 f0 77 67 86 f4 73 f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb Data Ascii: Xwgs9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:
2024-08-28 11:50:15 UTC	1390	IN	Data Raw: 4d 15 00 a4 81 86 68 ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a Data Ascii: Mh3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:
2024-08-28 11:50:15 UTC	1390	IN	Data Raw: a0 8e 2c ba 65 e8 66 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 Data Ascii: ,ef4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$
2024-08-28 11:50:15 UTC	1390	IN	Data Raw: 3f ec fa 62 d7 ae 70 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 Data Ascii: ?bpnh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u
2024-08-28 11:50:15 UTC	1390	IN	Data Raw: f9 d6 22 50 e1 7c 45 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 Data Ascii: "P\|E'3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9
2024-08-28 11:50:15 UTC	1390	IN	Data Raw: 4e 57 c1 ef e1 60 9a 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f Data Ascii: NW`^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gOD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49784	172.64.41.3	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-28 11:50:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-28 11:50:17 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 28 Aug 2024 11:50:17 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ba415366bc74333-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 11:50:17 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 da 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49783	172.64.41.3	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-28 11:50:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-28 11:50:17 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 28 Aug 2024 11:50:17 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ba4153688bf72a4-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 11:50:17 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49786	162.159.61.3	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-28 11:50:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-28 11:50:17 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 28 Aug 2024 11:50:17 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ba41536eeb94370-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 11:50:17 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0e 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49789	152.195.19.97	443	7500	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:33 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725450614&P2=404&P3=2&P4=XToCa%2fQ5PRkCvqJJYUHBCmocjJ7OcFPCaGwhzGhWXpBLw%2bBKrigHVygrIXmSt1nZRhmuaWHq6CB1CWtZY41Rog%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: jHlsqcRllQWYhFvwfIMyZK Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-28 11:50:33 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4772364 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 28 Aug 2024 11:50:33 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-08-28 11:50:33 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49794	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:50:53 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=nlpFYkMm1BY8RD1&MD=h25S4Nal HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-28 11:50:53 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: befbd674-eced-44cd-8be2-8fc7326f0c50 MS-RequestId: 0d39db87-2f02-430d-8372-e556d471dac1 MS-CV: pKhZw6vw/0iJi1mj.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 28 Aug 2024 11:50:53 GMT Connection: close Content-Length: 30005
2024-08-28 11:50:53 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-28 11:50:53 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49802	23.200.0.9	443	7980	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:51:59 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-28 11:52:01 UTC	360	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: content-type Date: Wed, 28 Aug 2024 11:52:00 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.09ac2d17.1724845920.e244104 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49803	23.200.0.9	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 11:52:01 UTC	382	OUT	POST /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Content-Length: 940 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-28 11:52:01 UTC	940	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 32 30 30 32 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 37 30 30 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 33 2e 31 30 37 2e 36 2e 31 35 38 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 75 73 69 6e 65 73 73 2e 62 69 6e Data Ascii: [{"age":120020,"body":{"elapsed_time":700,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"13.107.6.158","status_code":401,"type":"http.error"},"type":"network-error","url":"https://business.bin
2024-08-28 11:52:01 UTC	378	IN	HTTP/1.1 503 Service Unavailable Content-Length: 326 Content-Type: text/html; charset=us-ascii Date: Wed, 28 Aug 2024 11:52:01 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.09ac2d17.1724845921.e2448c2 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-08-28 11:52:01 UTC	326	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><

Target ID:	0
Start time:	07:49:53
Start date:	28/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x700000
File size:	917'504 bytes
MD5 hash:	B5A6E633330EDE88B76777532223017B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	07:49:53
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:49:54
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2036,i,8244173098469223408,5873798971451849439,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:49:54
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	07:49:54
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	07:49:58
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3412 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:49:58
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3428 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:49:59
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7280 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff692e90000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:49:59
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7280 --field-trial-handle=2220,i,6821153972736630709,3814780333535429894,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff692e90000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:50:09
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	07:50:10
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	07:50:10
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4300 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:50:11
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6044 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:8
Imagebase:	0x7ff692e90000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:50:11
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6044 --field-trial-handle=2096,i,15136290577712819461,2497667495142092993,262144 /prefetch:8
Imagebase:	0x7ff692e90000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:50:18
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:50:18
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2064,i,3874761813740752190,4412825139045051172,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:50:26
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:50:26
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2008,i,5910061952116798662,9188178210013363448,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:50:39
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:50:39
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2052,i,8898610241083632541,3764320059001856009,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.1%
Total number of Nodes:	1382
Total number of Limit Nodes:	38

Executed Functions

Function 0071F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
keyboardthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0071F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0075F474
IsIconic.USER32(00000000), ref: 0075F47D
ShowWindow.USER32(00000000,00000009), ref: 0075F48A
SetForegroundWindow.USER32(00000000), ref: 0075F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0075F4AA
GetCurrentThreadId.KERNEL32 ref: 0075F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0075F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0075F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0075F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0075F4DE
SetForegroundWindow.USER32(00000000), ref: 0075F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0075F4F6
keybd_event.USER32(00000012,00000000), ref: 0075F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0075F50B
keybd_event.USER32(00000012,00000000), ref: 0075F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0075F519
keybd_event.USER32(00000012,00000000), ref: 0075F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0075F528
keybd_event.USER32(00000012,00000000), ref: 0075F52D
SetForegroundWindow.USER32(00000000), ref: 0075F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0075F557

Strings

Shell_TrayWnd, xrefs: 0075F46F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: d4604cd1655c97099567a36da721b976ee5afae75c8d63810b0100b94d68f20c
Instruction ID: 61a340a3037905115773d19141d0f9bfed7a53a3838065a0082c20edcabbf738
Opcode Fuzzy Hash: d4604cd1655c97099567a36da721b976ee5afae75c8d63810b0100b94d68f20c
Instruction Fuzzy Hash: 9531A071A40318BFEF216BB55C4AFBF7E6CEB44B50F204066FA00E61D1D6B85D11AAA4

Function 007042DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0070430D

Part of subcall function 00706B57: _wcslen.LIBCMT ref: 00706B6A

GetCurrentProcess.KERNEL32(?,0079CB64,00000000,?,?), ref: 00704422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00704429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00704454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00704466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00704474
FreeLibrary.KERNEL32(00000000,?,?), ref: 0070447B
GetSystemInfo.KERNEL32(?,?,?), ref: 007044A0

Strings

|O, xrefs: 007436F8
kernel32.dll, xrefs: 0070444F
GetNativeSystemInfo, xrefs: 00704460

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: f79586b71dc1b5c502b7ca076a20587634b89a00823c0439d0e7c38f2c9a5bc0
Instruction ID: 1ba8edc32495ae1932a08227b69b63547d38cc6de3133663d0d9cf5cdc4304ee
Opcode Fuzzy Hash: f79586b71dc1b5c502b7ca076a20587634b89a00823c0439d0e7c38f2c9a5bc0
Instruction Fuzzy Hash: 94A196A190B3C0FFCB12C769BD811957FF5AB26340B98D59BE18593B62D23C4505CB2E

Function 007042A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,007050AA,?,?,00000000,00000000), ref: 007042B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,007050AA,?,?,00000000,00000000), ref: 007042C9
LoadResource.KERNEL32(?,00000000,?,?,007050AA,?,?,00000000,00000000,?,?,?,?,?,?,00704F20), ref: 007435BE
SizeofResource.KERNEL32(?,00000000,?,?,007050AA,?,?,00000000,00000000,?,?,?,?,?,?,00704F20), ref: 007435D3
LockResource.KERNEL32(007050AA,?,?,007050AA,?,?,00000000,00000000,?,?,?,?,?,?,00704F20,?), ref: 007435E6

Strings

SCRIPT, xrefs: 007042BF

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: ac0b549b148f11757cb6b4b96f9f4c3b36635e77498994ac614e1a6a249d7538
Instruction ID: 599e75663fc5a70eab8b69dcf99917400b7ef431546d65845ddad17ccdf96237
Opcode Fuzzy Hash: ac0b549b148f11757cb6b4b96f9f4c3b36635e77498994ac614e1a6a249d7538
Instruction Fuzzy Hash: 71117CB1200700FFDF228B65DC49F277BB9FBC5B51F10826AB502D6290DB75D8018630

Function 00742BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00702B6B

Part of subcall function 00703A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007D1418,?,00702E7F,?,?,?,00000000), ref: 00703A78

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,007C2224), ref: 00742C10
ShellExecuteW.SHELL32(00000000,?,?,007C2224), ref: 00742C17

Strings

runas, xrefs: 00742C0B

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: f5c92c82a0dd9c5ff8c8f537ac3e83f094fde0010a7e392d051062c0ac6dd3c1
Instruction ID: 7a303786c9c27f9841ab62adc2cb0fe7734565264fc0b9abf49d0073d2f18e08
Opcode Fuzzy Hash: f5c92c82a0dd9c5ff8c8f537ac3e83f094fde0010a7e392d051062c0ac6dd3c1
Instruction Fuzzy Hash: 0F11B472208381EAC714FF60D89EA7EB7E89B91340F84562EF146521E3DF2D994AC712

Function 0076DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00745222), ref: 0076DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0076DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0076DBEE
FindClose.KERNEL32(00000000), ref: 0076DBFA

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 34bd34cb432a12316e8f779c23cbad8631aa0c8496fac84019faeaa36b4114b3
Instruction ID: d422385cfe6318e49c92ddcc0bca7532cf51438032b10b0e5ac425e928baefaa
Opcode Fuzzy Hash: 34bd34cb432a12316e8f779c23cbad8631aa0c8496fac84019faeaa36b4114b3
Instruction Fuzzy Hash: 72F0A0308209185BD631AB78AC0D8AA377CAF01334F508703F836C20E0EBB95D9686E9

Function 0078AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0078B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0078B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0078B1D4
_wcslen.LIBCMT ref: 0078B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0078B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0078B236
_wcslen.LIBCMT ref: 0078B332

Part of subcall function 007705A7: GetStdHandle.KERNEL32(000000F6), ref: 007705C6

_wcslen.LIBCMT ref: 0078B34B
_wcslen.LIBCMT ref: 0078B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0078B3B6
GetLastError.KERNEL32(00000000), ref: 0078B407
CloseHandle.KERNEL32(?), ref: 0078B439
CloseHandle.KERNEL32(00000000), ref: 0078B44A
CloseHandle.KERNEL32(00000000), ref: 0078B45C
CloseHandle.KERNEL32(00000000), ref: 0078B46E
CloseHandle.KERNEL32(?), ref: 0078B4E3

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: d9d865a21f99c49bc0a2675f3ca56d49ffc613f0db1e597046d0db3f102c1a35
Instruction ID: 7470f8141705f2fb7a46a0a2be684f1efc459676f89c690714f24b9474647ef0
Opcode Fuzzy Hash: d9d865a21f99c49bc0a2675f3ca56d49ffc613f0db1e597046d0db3f102c1a35
Instruction Fuzzy Hash: 94F19C31608340DFCB14EF24C895B6EBBE5AF85314F18855DF8999B2A2CB39EC45CB52

Function 0070D730 Relevance: 21.6, APIs: 14, Instructions: 631sleepsynchronizationtimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0070D807
timeGetTime.WINMM ref: 0070DA07
Sleep.KERNELBASE(0000000A), ref: 0070DBB1
Sleep.KERNEL32(0000000A), ref: 00752B76
GetExitCodeProcess.KERNEL32(?,?), ref: 00752C11
WaitForSingleObject.KERNEL32(?,00000000), ref: 00752C29
CloseHandle.KERNEL32(?), ref: 00752C3D
Sleep.KERNEL32(?,CCCCCCCC,00000000), ref: 00752CA9

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Sleep$CloseCodeExitHandleInputObjectProcessSingleStateTimeWaittime
String ID:
API String ID: 388478766-0
Opcode ID: bef70138b6e275fb10b016b3574546cd53f01b286f9a4cf50d816cd1a90c4570
Instruction ID: 3de5b6d4c5d0d6a194d319e3ea2d74eee41c36e1060d5d10468091a0ee5ea82e
Opcode Fuzzy Hash: bef70138b6e275fb10b016b3574546cd53f01b286f9a4cf50d816cd1a90c4570
Instruction Fuzzy Hash: BF42DF70604341EFD739CF64C848BAAB7E1BF86311F54861AE855872D2D7BCAC49CB92

Function 00702CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00702D07
RegisterClassExW.USER32(00000030), ref: 00702D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00702D42
InitCommonControlsEx.COMCTL32(?), ref: 00702D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00702D6F
LoadIconW.USER32(000000A9), ref: 00702D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00702D94

Strings

AutoIt v3 GUI, xrefs: 00702D23
+, xrefs: 00702CF0
0, xrefs: 00702CE9
TaskbarCreated, xrefs: 00702D37

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: dc78c59240b7bdb2d99cb9aa07ae2c7da0f7fb7dad14eaac23edebf59bfc8fce
Instruction ID: 3e489d1f44f4e0a987e121135d6726ebd408b8109a05e72c3601300cf7c1daa0
Opcode Fuzzy Hash: dc78c59240b7bdb2d99cb9aa07ae2c7da0f7fb7dad14eaac23edebf59bfc8fce
Instruction Fuzzy Hash: 1721E3B1902248AFDF01DFA4EC59BDDBBB8FB08700F40811BF511A62A0D7B95541CFA8

Function 0074065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0074039A: CreateFileW.KERNELBASE(00000000,00000000,?,00740704,?,?,00000000,?,00740704,00000000,0000000C), ref: 007403B7

GetLastError.KERNEL32 ref: 0074076F
__dosmaperr.LIBCMT ref: 00740776
GetFileType.KERNELBASE(00000000), ref: 00740782
GetLastError.KERNEL32 ref: 0074078C
__dosmaperr.LIBCMT ref: 00740795
CloseHandle.KERNEL32(00000000), ref: 007407B5
CloseHandle.KERNEL32(?), ref: 007408FF
GetLastError.KERNEL32 ref: 00740931
__dosmaperr.LIBCMT ref: 00740938

Strings

H, xrefs: 007408BD

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 04efdc1fd6e3efa1f4bdf91f4e7743e5a00efaaf3c92d4282d5840723de1852d
Instruction ID: 0af0ad0515d27515a00041bfc374052d2c8895a88b266e2067257e2f11f99890
Opcode Fuzzy Hash: 04efdc1fd6e3efa1f4bdf91f4e7743e5a00efaaf3c92d4282d5840723de1852d
Instruction Fuzzy Hash: B9A12632A04118CFDF19AF78D855BAE7BB0EB06320F24415EF9159B292D7399D12CBD2

Function 0070344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00703A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007D1418,?,00702E7F,?,?,?,00000000), ref: 00703A78

Part of subcall function 00703357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00703379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0070356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0074318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 007431CE
RegCloseKey.ADVAPI32(?), ref: 00743210
_wcslen.LIBCMT ref: 00743277
_wcslen.LIBCMT ref: 00743286

Strings

\, xrefs: 0074328C
\Include\, xrefs: 00703527
Include, xrefs: 00743184, 007431C5
Software\AutoIt v3\AutoIt, xrefs: 00703560

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 1abd12408a1a902938be0b3241efa7460c9dc9ea9ad7c6c9c363a328cc477ad1
Instruction ID: 9da94b0131ce0503e3500214857364d531172c3f5f02bb83b9c3cbb5f4386c8d
Opcode Fuzzy Hash: 1abd12408a1a902938be0b3241efa7460c9dc9ea9ad7c6c9c363a328cc477ad1
Instruction Fuzzy Hash: 31718D71505301EEC704EF29EC8585BBBF8BF94340F40852EF545831A2EB7C9A4ACB65

Function 00702B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00702B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00702B9D
LoadIconW.USER32(00000063), ref: 00702BB3
LoadIconW.USER32(000000A4), ref: 00702BC5
LoadIconW.USER32(000000A2), ref: 00702BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00702BEF
RegisterClassExW.USER32(?), ref: 00702C40

Part of subcall function 00702CD4: GetSysColorBrush.USER32(0000000F), ref: 00702D07
Part of subcall function 00702CD4: RegisterClassExW.USER32(00000030), ref: 00702D31
Part of subcall function 00702CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00702D42
Part of subcall function 00702CD4: InitCommonControlsEx.COMCTL32(?), ref: 00702D5F
Part of subcall function 00702CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00702D6F
Part of subcall function 00702CD4: LoadIconW.USER32(000000A9), ref: 00702D85
Part of subcall function 00702CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00702D94

Strings

0, xrefs: 00702C0F
AutoIt v3, xrefs: 00702C2F
#, xrefs: 00702C16

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 802da96c233ebd5e6d15b2b1336f535374189c33e425b472ba8d0039e314626d
Instruction ID: 413df99bf573e4344f6ec95b8858ec5d5fcde52eceb32d0ba899cdbec52bbf17
Opcode Fuzzy Hash: 802da96c233ebd5e6d15b2b1336f535374189c33e425b472ba8d0039e314626d
Instruction Fuzzy Hash: 22214C70E02318BBDB119FE5EC59A9D7FB4FB08B50F80812BE500A66A0D3B90540CF98

Function 0070B710 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0070BB4E

Strings

p#}, xrefs: 0075024F
p#}, xrefs: 00750263
p%}, xrefs: 0070B8DC
p#}, xrefs: 0070BB6B
p#}, xrefs: 0070BA72
x#}, xrefs: 00750168
p%}, xrefs: 0070BB32
x#}, xrefs: 00750207

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: p#}$p#}$p#}$p#}$p%}$p%}$x#}$x#}
API String ID: 1385522511-210118448
Opcode ID: 87a5b5ec9bc27a6c069b0dda7095b23e33e767fc0abff14e9de7a1e436c0cc1b
Instruction ID: ec605d7e78951ede8b2736d1e6128005d5eb667a293a9917f8ed8b26e22ae3ba
Opcode Fuzzy Hash: 87a5b5ec9bc27a6c069b0dda7095b23e33e767fc0abff14e9de7a1e436c0cc1b
Instruction Fuzzy Hash: 7932B074A00209DFDB24DF54C894ABEB7F5EF44310F14815AED05AB2A1D7BCAE86CB91

Function 00703170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0070316A,?,?), ref: 007031D8
KillTimer.USER32(?,00000001,?,?,?,?,?,0070316A,?,?), ref: 00703204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00703227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0070316A,?,?), ref: 00703232
CreatePopupMenu.USER32 ref: 00703246
PostQuitMessage.USER32(00000000), ref: 00703267

Strings

TaskbarCreated, xrefs: 0070322D

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: c73305dded756ede5c3f7d02dc3528ad809bb125c8aad847bee4cddf41abbe8d
Instruction ID: 1d35d74cdbf6058ac79a1f25e85dcbea1277f05b101674796dfea7817679c5f4
Opcode Fuzzy Hash: c73305dded756ede5c3f7d02dc3528ad809bb125c8aad847bee4cddf41abbe8d
Instruction Fuzzy Hash: 22412635240204FBDF155BB89C2DB793BADFB09340F848327F902862E2C77D9A4297A5

Function 00702C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00702C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00702CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00701CAD,?), ref: 00702CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00701CAD,?), ref: 00702CCF

Strings

edit, xrefs: 00702CAC
AutoIt v3, xrefs: 00702C89, 00702C8E, 00702C8F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 17e4b9bbfd81e8528de5a3e1be5182604151025e81f489b436097f5500504e2d
Instruction ID: 2589e3d7d6f0aa35f43ced9b8d33811eef524faaac327a9c776e8b769a732f72
Opcode Fuzzy Hash: 17e4b9bbfd81e8528de5a3e1be5182604151025e81f489b436097f5500504e2d
Instruction Fuzzy Hash: CDF0DA756412907BEB311717BC08E772FBDD7C6F60B80805BF904A25A0C6691851DAB8

Function 0076E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0076E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0076E9A5
Sleep.KERNEL32(00000000), ref: 0076E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0076E9B7
Sleep.KERNELBASE ref: 0076E9F3

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 39ea12dd3f14ecf5d53e2e1389725d5c11cb66300b4fd8d80b84afb80cf714ad
Instruction ID: 1b57157041e44960103b6b35420731a5bbd2ec99b151f78b887a4aeb68879735
Opcode Fuzzy Hash: 39ea12dd3f14ecf5d53e2e1389725d5c11cb66300b4fd8d80b84afb80cf714ad
Instruction Fuzzy Hash: A5018C75C0162DDBCF00AFE4DC59AEDBB78FF08700F444546E902B2241DB38A552CBAA

Function 00703B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00703B0F,SwapMouseButtons,00000004,?), ref: 00703B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00703B0F,SwapMouseButtons,00000004,?), ref: 00703B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00703B0F,SwapMouseButtons,00000004,?), ref: 00703B83

Strings

Control Panel\Mouse, xrefs: 00703B3E

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 396002a4fed041b7c13ee410e0ee2aa888302486b4f074937d0b309cf5cdc5c2
Instruction ID: bd9dff7c2bcf0b86668e3cb6827feba11fdabb2f0dbce50b971c60cc354ce93b
Opcode Fuzzy Hash: 396002a4fed041b7c13ee410e0ee2aa888302486b4f074937d0b309cf5cdc5c2
Instruction Fuzzy Hash: 58112AB5510208FFDB21CFA9DC85AAEBBFCEF04748B10855AA805D7150E2359E459764

Function 00703923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 007433A2

Part of subcall function 00706B57: _wcslen.LIBCMT ref: 00706B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00703A04

Strings

Line: , xrefs: 007433EB

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 9d698433a35b669a41a7bb108951e9056adb3701bec6b45e477be2533a9f5bee
Instruction ID: ed3a7753648e31e1b5f3614aa6c91926f8366e2cc8fa40504e1b6c4778d65c39
Opcode Fuzzy Hash: 9d698433a35b669a41a7bb108951e9056adb3701bec6b45e477be2533a9f5bee
Instruction Fuzzy Hash: 9431C171509300EAC725EB24DC49BEBB7ECAF40714F408A2BF599821D1DB7CAA49C7C6

Function 00702DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00742C8C

Part of subcall function 00703AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00703A97,?,?,00702E7F,?,?,?,00000000), ref: 00703AC2

Part of subcall function 00702DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00702DC4

Strings

`e|, xrefs: 00742C85
X, xrefs: 00742C5A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`e|
API String ID: 779396738-3909034667
Opcode ID: 91408d900c14829e0daef670ad2838eb70f269fb46016cbc99c8ecd389daf1fc
Instruction ID: a2a653a9cf0595833e47651f70e4157de6a4ae73a25846c02ac9c7941e11d5c5
Opcode Fuzzy Hash: 91408d900c14829e0daef670ad2838eb70f269fb46016cbc99c8ecd389daf1fc
Instruction Fuzzy Hash: 08219671A00298DBCB41EF94D849BDE7BFC9F49304F50805AE505A7282DBBC5A898B61

Function 0071FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00720668

Part of subcall function 007232A4: RaiseException.KERNEL32(?,?,?,0072068A,?,007D1444,?,?,?,?,?,?,0072068A,00701129,007C8738,00701129), ref: 00723304

__CxxThrowException@8.LIBVCRUNTIME ref: 00720685

Strings

Unknown exception, xrefs: 00720692

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 8ee4a27df8bbe23c17aef43a97db52037abdb2ccd04f2bccdbac688e1ff2c131
Instruction ID: 96ffdfa2b878e6e573aa0089c4756aa6fd2a9f1126799ef28ea6a493e4fae8d8
Opcode Fuzzy Hash: 8ee4a27df8bbe23c17aef43a97db52037abdb2ccd04f2bccdbac688e1ff2c131
Instruction Fuzzy Hash: 89F0AF24A0021DE7CB04B6A8F85ADAE7B6C6E00310B604535F824965D3EF7DDB6586E1

Function 007010F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00701BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00701BF4
Part of subcall function 00701BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00701BFC
Part of subcall function 00701BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00701C07
Part of subcall function 00701BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00701C12
Part of subcall function 00701BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00701C1A
Part of subcall function 00701BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00701C22

Part of subcall function 00701B4A: RegisterWindowMessageW.USER32(00000004,?,007012C4), ref: 00701BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0070136A
OleInitialize.OLE32 ref: 00701388
CloseHandle.KERNEL32(00000000,00000000), ref: 007424AB

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 0854f5873045d3f066ab41294e82b3212111504c752a13854423e925537d6653
Instruction ID: a4e066809f6b0f41a633379466635b1f3c958a167351c2291cfeeb3a73f7df93
Opcode Fuzzy Hash: 0854f5873045d3f066ab41294e82b3212111504c752a13854423e925537d6653
Instruction Fuzzy Hash: D371A9B4A02240EEC784DFB9B9496553BF0AB883643C4C26BD00BC73A2EB3C5461CF59

Function 0076C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00703923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00703A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0076C259
KillTimer.USER32(?,00000001,?,?), ref: 0076C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0076C270

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: cfc6d9571e8298e8949dc9ec7772a3d12253b84f440e674d5afe7f49f20ddd94
Instruction ID: 3a4dde85f411d63aaaf2f6a3524d1093006f3b89518cd54021f1d5a768e3fc03
Opcode Fuzzy Hash: cfc6d9571e8298e8949dc9ec7772a3d12253b84f440e674d5afe7f49f20ddd94
Instruction Fuzzy Hash: A9319370904344AFEB23DF648895BE7BBFCAF06308F04449ADADA97241C7785A85CB55

Function 007386AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,007385CC,?,007C8CC8,0000000C), ref: 00738704
GetLastError.KERNEL32(?,007385CC,?,007C8CC8,0000000C), ref: 0073870E
__dosmaperr.LIBCMT ref: 00738739

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: daf8c77105727132c271b1d3b7340197778b69ffe1222fda44566757cee08b7f
Instruction ID: 114a618037103a476d1cfd97a50b7fc7250d9119a190d6cf901aebc7eb3256fd
Opcode Fuzzy Hash: daf8c77105727132c271b1d3b7340197778b69ffe1222fda44566757cee08b7f
Instruction Fuzzy Hash: 30018E33605720D7F6B06334684B77E27594B82778F39011AF8158B0D3DEBDCC818192

Function 0070DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 0070DB7B
DispatchMessageW.USER32(?), ref: 0070DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0070DB9F
Sleep.KERNELBASE(0000000A), ref: 0070DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00751CC9

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: ee7e1517435e11bb26435ee06f4c96d1b49abe49c9f077cfdc5e1f303e649255
Instruction ID: d1bbab48b50a4eb77ac7d54823233c2a5b574b54f9662e50ddf254847cb8061b
Opcode Fuzzy Hash: ee7e1517435e11bb26435ee06f4c96d1b49abe49c9f077cfdc5e1f303e649255
Instruction Fuzzy Hash: B8F0F470644340DBEB30D7A09C49FEA73BDEB45311F508619E659870D0DB789449DB25

Function 00711310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 007117F6

Strings

CALL, xrefs: 007117C6

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 4a8ffcce8ba13e0f66c6f4913847523515a9b487e9652549d52139ee12011dd8
Instruction ID: 66e4db4943a641686998b4d3219611b4f5ff31879cce3da1649159a638d878bf
Opcode Fuzzy Hash: 4a8ffcce8ba13e0f66c6f4913847523515a9b487e9652549d52139ee12011dd8
Instruction Fuzzy Hash: E522BD70608341DFC714CF18C484AAABBF1BF85314F94895DF9968B3A2D779E895CB82

Function 00703837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00703908

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: caf12b09a3949e84ed59bc8075615dea24a5653ea9b371e8b6dbf000c6ac3841
Instruction ID: a4264fb4ff1feac87c74587a8210fe824317e5d8446aff51828fc6c5199744f1
Opcode Fuzzy Hash: caf12b09a3949e84ed59bc8075615dea24a5653ea9b371e8b6dbf000c6ac3841
Instruction Fuzzy Hash: D831BF70605301DFD721DF24D884797BBF8FB49308F004A6EF59A83290E779AA44CB52

Function 0071F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0071F661

Part of subcall function 0070D730: GetInputState.USER32 ref: 0070D807

Sleep.KERNEL32(00000000), ref: 0075F2DE

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 5dded2d93822228a93dc2d6c9fe60b3fe904fb13f62c0dd76dccc8feb5807a40
Instruction ID: c0fd2fb6483134985d7619fe2fa4d74bb9c81a313d75495d71dd6c4b35ef1118
Opcode Fuzzy Hash: 5dded2d93822228a93dc2d6c9fe60b3fe904fb13f62c0dd76dccc8feb5807a40
Instruction Fuzzy Hash: 02F08C71280205DFD310EFA9D849BAAB7E8FF49761F00416AE85DC73A0DB74AC00CB94

Function 00792598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00792649

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 2004a0b558fbe47cfde76c1147cb1203c728e272c518b4295bcf5ca711ef7f37
Instruction ID: b883f5bb9dd1d1170d5a79880ed106097d3fef570986e55607080797f83d686a
Opcode Fuzzy Hash: 2004a0b558fbe47cfde76c1147cb1203c728e272c518b4295bcf5ca711ef7f37
Instruction Fuzzy Hash: FD21C275200215BFDB10EF18D8D0D76B799EB44368B1481ADE8568B793CB79ED42CB90

Function 007913B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00791420

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8ff2eb53f43a0790672f8fb7cb5faac7250216babc831ad88af6999691b351ac
Instruction ID: 861f3300318a95d69d3e48cb90833021d17a1a7ea3250878170c5429e522aa98
Opcode Fuzzy Hash: 8ff2eb53f43a0790672f8fb7cb5faac7250216babc831ad88af6999691b351ac
Instruction Fuzzy Hash: 2E319E71204243EFDB14EF29D495B69B7A2FF48324F448268E8168B292DB39FC51CBD1

Function 00704ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00704E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00704EDD,?,007D1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00704E9C
Part of subcall function 00704E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00704EAE
Part of subcall function 00704E90: FreeLibrary.KERNEL32(00000000,?,?,00704EDD,?,007D1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00704EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,007D1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00704EFD

Part of subcall function 00704E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00743CDE,?,007D1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00704E62
Part of subcall function 00704E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00704E74
Part of subcall function 00704E59: FreeLibrary.KERNEL32(00000000,?,?,00743CDE,?,007D1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00704E87

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 00ae29ae9c36a37cb865dbf13a7f51b5246bd677ffe73b9b64b058be5bcdcb34
Instruction ID: a2ead5aec99a97718dbdbe7ae85fde52c3638a7c1cf4917d3d38ca907024bc1a
Opcode Fuzzy Hash: 00ae29ae9c36a37cb865dbf13a7f51b5246bd677ffe73b9b64b058be5bcdcb34
Instruction Fuzzy Hash: 161127B1600206EACF10BB60DC0BFAD77E4AF40711F10852DF642A61C1EFB8AA059B50

Function 00738402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00738440

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 2596838ea0aa6db92968e95934fcc28e7d82d69b9d4ceb45836c8c2978691e89
Instruction ID: aad7e28aae462a080ef95f8e1f5c8d76d0beb6fd23ad48178d3fd82b870303ab
Opcode Fuzzy Hash: 2596838ea0aa6db92968e95934fcc28e7d82d69b9d4ceb45836c8c2978691e89
Instruction Fuzzy Hash: 4211487190420AAFDF05DF58E94499A7BF4EF48300F104059F808AB312DB31EA11CBA5

Function 00735000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00734C7D: RtlAllocateHeap.NTDLL(00000008,00701129,00000000,?,00732E29,00000001,00000364,?,?,?,0072F2DE,00733863,007D1444,?,0071FDF5,?), ref: 00734CBE

_free.LIBCMT ref: 0073506C

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 5b015ef142647dc0ef836d283146d716a36ae034d3fa0bd636527d67718b44f9
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: AE014972204704ABF3358F75D885A5AFBECFB89370F25061DE184932C1EA35A805C7B4

Function 007929BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,007914B5,?), ref: 00792A01

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 7694978254e67994e521102516190bfd0916e558e5d02632f5f3c1a885e45502
Instruction ID: 1cb1716234234edec9b48d7531d6fbea3da2ee7379f0fcede242e113cda16c8e
Opcode Fuzzy Hash: 7694978254e67994e521102516190bfd0916e558e5d02632f5f3c1a885e45502
Instruction Fuzzy Hash: 0601D236300641BFDB24EA2CE444B223792EB85314F28C468C4479B252DB3AFC43C790

Function 0072E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: ff5ed68acff3ecbab3d32f4431f3af6e912c538b78e496c1241130bf45f91824
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 2AF0F432510A34EBE6313A69AC09B5A33A89F52331F100729F560921D3DB7CA80286A6

Function 0079149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 007914EB

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: bd639af3bfc2a6b76ab08702b8232286168cb2478063af4434409aade38eca82
Instruction ID: 57071bb6c931e06a5b33cd7e1cacfee6482ca2f8b25de83443ad5714f76a536a
Opcode Fuzzy Hash: bd639af3bfc2a6b76ab08702b8232286168cb2478063af4434409aade38eca82
Instruction Fuzzy Hash: 3701F7353047829FDB21DF69E440826BB95FF89324794C05DE84A8F752D636ED82CBC0

Function 00734C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00701129,00000000,?,00732E29,00000001,00000364,?,?,?,0072F2DE,00733863,007D1444,?,0071FDF5,?), ref: 00734CBE

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a66b98467020a5530ef098d087997506807d2f829ec1bf9c23c2854c62332ec2
Instruction ID: d9f22e04d88faa2c511b7c373c64ee77361e3e950348358c09e40a758c016367
Opcode Fuzzy Hash: a66b98467020a5530ef098d087997506807d2f829ec1bf9c23c2854c62332ec2
Instruction Fuzzy Hash: 6EF0B432602234A6FB295F62AC09B5A3798BF417A0F15A122F815A6293CA7CFC0146B0

Function 00733820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,007D1444,?,0071FDF5,?,?,0070A976,00000010,007D1440,007013FC,?,007013C6,?,00701129), ref: 00733852

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 69dfc540eeb7ec40c48798bc79d0d85d3a6d3c032fdd34ecea490107c900058b
Instruction ID: 7521abc1d9ed14c51fa501d822f4f1fea89f9fee13eaa1cb9b8f63b72a2c2aaf
Opcode Fuzzy Hash: 69dfc540eeb7ec40c48798bc79d0d85d3a6d3c032fdd34ecea490107c900058b
Instruction Fuzzy Hash: 3BE0E532101234AAFA312A66AC05BDA3758AF427B0F050022FC04A25A2CB1DDD0281F8

Function 00704F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,007D1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00704F6D

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 62f09e1281db630971b9c894618148d60419553536a4a122da6a95150f595723
Instruction ID: 4db22098ba80fc688c94f75b5ac8787187a3293a1d415b2f12e44605fba4fa29
Opcode Fuzzy Hash: 62f09e1281db630971b9c894618148d60419553536a4a122da6a95150f595723
Instruction Fuzzy Hash: 9CF030B1105752CFDB349F64E494822B7E4EF143193188A7EE3DA82551C779A844DF10

Function 00792A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00792A66

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 122e3405fba0accc510e540e7a4ac723b35d1b630b78444868792b33ead78edf
Instruction ID: 82fede0d3bc605ec5965066a4cad257bbf86ee6b25ec91a974a92038a013cfad
Opcode Fuzzy Hash: 122e3405fba0accc510e540e7a4ac723b35d1b630b78444868792b33ead78edf
Instruction Fuzzy Hash: E8E04F77354116BACB14FA30EC848FA735CEB613957108536AC1BC2101DB389996CBA0

Function 00702DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00702DC4

Part of subcall function 00706B57: _wcslen.LIBCMT ref: 00706B6A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: a73ce5a10fb14efff8817d70f1b1d743034feb1557a5d3da3c1b2be837a1f098
Instruction ID: 27c0f9e29a5d8daf6498e633b4166fcf12af5742ce933d77dcd0e3b952953ff7
Opcode Fuzzy Hash: a73ce5a10fb14efff8817d70f1b1d743034feb1557a5d3da3c1b2be837a1f098
Instruction Fuzzy Hash: 69E0CDB26001249BCB11E7589C09FDA77EDDFC8790F054171FD09D7248DA64AD858550

Function 00702B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00703837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00703908

Part of subcall function 0070D730: GetInputState.USER32 ref: 0070D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00702B6B

Part of subcall function 007030F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0070314E

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 97ba2ec492a07caaf123053c8efa2522f1c12a5bb9137a1bee13278dec0ff146
Instruction ID: a0372b331140ac0fc691f83e6959d9226e4edeaf38b6dae853b6fe66a2afc86e
Opcode Fuzzy Hash: 97ba2ec492a07caaf123053c8efa2522f1c12a5bb9137a1bee13278dec0ff146
Instruction Fuzzy Hash: EBE08662304244D7CA04BBB4985A57DB7DD9BD1351F40573FF142432E3DE2C49464252

Function 00763D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00763D18

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: b9e47d7e23ecfdec15f791df24fa8f5c16b0f96e685cc2faab22e5063177df13
Instruction ID: a3817bc69e1e4aa419ab8f56a53aa74ee08bbf5ad7c6b85c8db303e5c5831220
Opcode Fuzzy Hash: b9e47d7e23ecfdec15f791df24fa8f5c16b0f96e685cc2faab22e5063177df13
Instruction Fuzzy Hash: 6DD012E06A03087EFB0083718C0BEBB32ACC316A81F008BA57A02D65C1D9A4DE090130

Function 0074039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00740704,?,?,00000000,?,00740704,00000000,0000000C), ref: 007403B7

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 48229f700b6d0411db6ee197a228b00e7d218df2bb1a6fb5d24e90e5bd367312
Instruction ID: 277f44f106ebd114c53dd7436127ff0e821b0d458e9fc318f432b37aee4c1359
Opcode Fuzzy Hash: 48229f700b6d0411db6ee197a228b00e7d218df2bb1a6fb5d24e90e5bd367312
Instruction Fuzzy Hash: 03D06C3204010DBBDF028F84DD06EDA3BAAFB48714F018000BE1856020C736E822AB98

Function 00701CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00701CBC

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 753c7ef9f1badbe84d56a3d9c76acca532267d24d2cc4c5e645a5c7fb3125c88
Instruction ID: b1b6fb201874068e682ace97bd3e0bbc021a85b1825b02652cd074928f073bb0
Opcode Fuzzy Hash: 753c7ef9f1badbe84d56a3d9c76acca532267d24d2cc4c5e645a5c7fb3125c88
Instruction Fuzzy Hash: A3C09B35281304AFF6154784BC5BF107774A358B00F54C003F609555E3C3A51431D658

Non-executed Functions

Function 00799576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00719BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00719BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0079961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0079965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0079969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007996C9
SendMessageW.USER32 ref: 007996F2
GetKeyState.USER32(00000011), ref: 0079978B
GetKeyState.USER32(00000009), ref: 00799798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 007997AE
GetKeyState.USER32(00000010), ref: 007997B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007997E9
SendMessageW.USER32 ref: 00799810
SendMessageW.USER32(?,00001030,?,00797E95), ref: 00799918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0079992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00799941
SetCapture.USER32(?), ref: 0079994A
ClientToScreen.USER32(?,?), ref: 007999AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 007999BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007999D6
ReleaseCapture.USER32 ref: 007999E1
GetCursorPos.USER32(?), ref: 00799A19
ScreenToClient.USER32(?,?), ref: 00799A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00799A80
SendMessageW.USER32 ref: 00799AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00799AEB
SendMessageW.USER32 ref: 00799B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00799B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00799B4A
GetCursorPos.USER32(?), ref: 00799B68
ScreenToClient.USER32(?,?), ref: 00799B75
GetParent.USER32(?), ref: 00799B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00799BFA
SendMessageW.USER32 ref: 00799C2B
ClientToScreen.USER32(?,?), ref: 00799C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00799CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00799CDE
SendMessageW.USER32 ref: 00799D01
ClientToScreen.USER32(?,?), ref: 00799D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00799D82

Part of subcall function 00719944: GetWindowLongW.USER32(?,000000EB), ref: 00719952

GetWindowLongW.USER32(?,000000F0), ref: 00799E05

Strings

p#}, xrefs: 00799990
@GUI_DRAGID, xrefs: 0079997D
F, xrefs: 00799D07

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#}
API String ID: 3429851547-3317532684
Opcode ID: 28ddc294a7697689253a7e24d7c92c40c5c85117e7a023da9a3a49c4a5a26550
Instruction ID: 8552649ccd0e769501ced7890e6c1a130604db29f6370fbed31be11f0984fcb7
Opcode Fuzzy Hash: 28ddc294a7697689253a7e24d7c92c40c5c85117e7a023da9a3a49c4a5a26550
Instruction Fuzzy Hash: 4442AD31204240EFEB25CF68DC48AAABBF5FF49310F10465EF699872A1D739E891CB55

Function 00794873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 007948F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00794908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00794927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0079494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0079495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0079497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 007949AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 007949D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00794A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00794A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00794A7E
IsMenu.USER32(?), ref: 00794A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00794AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00794B20
GetWindowLongW.USER32(?,000000F0), ref: 00794B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00794BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00794C82
wsprintfW.USER32 ref: 00794CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00794CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00794CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00794D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00794D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00794D5A

Strings

%d/%02d/%02d, xrefs: 00794CA8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 87b08cff375933a81378f678324a0c9df0cae3a031f215c04806d12e966e7884
Instruction ID: 99a6c77eb65ec6794f474a72c9535e37b6cd1d25f93c02eac200b07796faebef
Opcode Fuzzy Hash: 87b08cff375933a81378f678324a0c9df0cae3a031f215c04806d12e966e7884
Instruction Fuzzy Hash: CF12EF71600215ABEF258F28EC49FAE7BF8EF45310F14816AF515EA2E1DB789942CB50

Function 00761201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 007616C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0076170D
Part of subcall function 007616C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0076173A
Part of subcall function 007616C3: GetLastError.KERNEL32 ref: 0076174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00761286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 007612A8
CloseHandle.KERNEL32(?), ref: 007612B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 007612D1
GetProcessWindowStation.USER32 ref: 007612EA
SetProcessWindowStation.USER32(00000000), ref: 007612F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00761310

Part of subcall function 007610BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007611FC), ref: 007610D4
Part of subcall function 007610BF: CloseHandle.KERNEL32(?,?,007611FC), ref: 007610E9

Strings

winsta0, xrefs: 007612CC
Z|, xrefs: 00761392
default, xrefs: 0076130B
, xrefs: 0076125A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Z|
API String ID: 22674027-2860067467
Opcode ID: 1381be325c57a17b374891056f9113c9695e1ce87248f7174c4e95abea7e9cac
Instruction ID: e091b97bd172c2b3f46c4c9e62a95b7f359bf8f2c536893fb7b0676a32c77ebe
Opcode Fuzzy Hash: 1381be325c57a17b374891056f9113c9695e1ce87248f7174c4e95abea7e9cac
Instruction Fuzzy Hash: 98819B71900248AFDF218FA4DC49FEE7FB9EF04700F18812AFD12A61A0CB399945CB65

Function 00760B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007610F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00761114
Part of subcall function 007610F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00760B9B,?,?,?), ref: 00761120
Part of subcall function 007610F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00760B9B,?,?,?), ref: 0076112F
Part of subcall function 007610F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00760B9B,?,?,?), ref: 00761136
Part of subcall function 007610F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0076114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00760BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00760C00
GetLengthSid.ADVAPI32(?), ref: 00760C17
GetAce.ADVAPI32(?,00000000,?), ref: 00760C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00760C6D
GetLengthSid.ADVAPI32(?), ref: 00760C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00760C8C
HeapAlloc.KERNEL32(00000000), ref: 00760C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00760CB4
CopySid.ADVAPI32(00000000), ref: 00760CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00760CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00760D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00760D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00760D45
HeapFree.KERNEL32(00000000), ref: 00760D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00760D55
HeapFree.KERNEL32(00000000), ref: 00760D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00760D65
HeapFree.KERNEL32(00000000), ref: 00760D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00760D78
HeapFree.KERNEL32(00000000), ref: 00760D7F

Part of subcall function 00761193: GetProcessHeap.KERNEL32(00000008,00760BB1,?,00000000,?,00760BB1,?), ref: 007611A1
Part of subcall function 00761193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00760BB1,?), ref: 007611A8
Part of subcall function 00761193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00760BB1,?), ref: 007611B7

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: dd4846010f8c237fbc13e91d2a0351a29fa501860b2caf834ba51c6cb2b60717
Instruction ID: c50aea6592514775f21f96e81fff12eff2e924226aec67e1fa1d71e0f6badb5c
Opcode Fuzzy Hash: dd4846010f8c237fbc13e91d2a0351a29fa501860b2caf834ba51c6cb2b60717
Instruction Fuzzy Hash: A2715E71A0020AAFDF11DFA4DC49BEFBBB8BF05300F048615ED15A6291D779A906CBA4

Function 0077EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0079CC08), ref: 0077EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0077EB37
GetClipboardData.USER32(0000000D), ref: 0077EB43
CloseClipboard.USER32 ref: 0077EB4F
GlobalLock.KERNEL32(00000000), ref: 0077EB87
CloseClipboard.USER32 ref: 0077EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 0077EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0077EBC9
GetClipboardData.USER32(00000001), ref: 0077EBD1
GlobalLock.KERNEL32(00000000), ref: 0077EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 0077EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0077EC38
GetClipboardData.USER32(0000000F), ref: 0077EC44
GlobalLock.KERNEL32(00000000), ref: 0077EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0077EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0077EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0077ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 0077ECF3
CountClipboardFormats.USER32 ref: 0077ED14
CloseClipboard.USER32 ref: 0077ED59

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 267445dfb915418429015c75a32b1d592a6502a299b4f803a0cb88d77d560187
Instruction ID: 960a4d69a915933fde2922a5013d36d7f727826d5741638e11ff1a4aa028e8fa
Opcode Fuzzy Hash: 267445dfb915418429015c75a32b1d592a6502a299b4f803a0cb88d77d560187
Instruction Fuzzy Hash: 3161D474204301DFDB11EF24D889F2ABBE4AF88744F04855AF45A972E2DB39DD06CB62

Function 0077698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007769BE
FindClose.KERNEL32(00000000), ref: 00776A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00776A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00776A75

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00776AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00776ADF

Strings

%4d, xrefs: 00776BB1
%02d, xrefs: 00776C00, 00776C0A, 00776C5A, 00776CAA, 00776CFA, 00776D4A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00776B32
%03d, xrefs: 00776DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00776B6A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: d71008ba25c901a7c38fc60778badfdc8ef58948fa6c10d8fd611915a5492adc
Instruction ID: 3a84b51d95556f28570430d5d6396d254e1333a9db1c8b3c91c4715c3755c60c
Opcode Fuzzy Hash: d71008ba25c901a7c38fc60778badfdc8ef58948fa6c10d8fd611915a5492adc
Instruction Fuzzy Hash: 15D131B2508340EFC714EB64C895EABB7ECAF88704F444A1DF589D7191EB78EA44C762

Function 00779642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00779663
GetFileAttributesW.KERNEL32(?), ref: 007796A1
SetFileAttributesW.KERNEL32(?,?), ref: 007796BB
FindNextFileW.KERNEL32(00000000,?), ref: 007796D3
FindClose.KERNEL32(00000000), ref: 007796DE
FindFirstFileW.KERNEL32(*.*,?), ref: 007796FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0077974A
SetCurrentDirectoryW.KERNEL32(007C6B7C), ref: 00779768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00779772
FindClose.KERNEL32(00000000), ref: 0077977F
FindClose.KERNEL32(00000000), ref: 0077978F

Strings

*.*, xrefs: 007796F5

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: e664f0f1051dc6a23af70f3447d7c351be286cd7c67c1f02ccc8b613a0fbb1e9
Instruction ID: d9607ec1facca1690f225f3b49d93c859b719b4ea514c68d47d43b844b7c1318
Opcode Fuzzy Hash: e664f0f1051dc6a23af70f3447d7c351be286cd7c67c1f02ccc8b613a0fbb1e9
Instruction Fuzzy Hash: 9D31D572542219ABDF15EFB4EC49EDE77BCAF09360F108166FA09E2090DB3CDD418A64

Function 0077979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 007797BE
FindNextFileW.KERNEL32(00000000,?), ref: 00779819
FindClose.KERNEL32(00000000), ref: 00779824
FindFirstFileW.KERNEL32(*.*,?), ref: 00779840
SetCurrentDirectoryW.KERNEL32(?), ref: 00779890
SetCurrentDirectoryW.KERNEL32(007C6B7C), ref: 007798AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 007798B8
FindClose.KERNEL32(00000000), ref: 007798C5
FindClose.KERNEL32(00000000), ref: 007798D5

Part of subcall function 0076DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0076DB00

Strings

*.*, xrefs: 0077983B

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 06e380a8440d3d394990a2897ef6c35b812df0eb7b3bcce1b054c8a8a708457a
Instruction ID: a0c6deb0b67c94467a8483de8c606cd28f2394106fc79c2c3c377961c4e7cabb
Opcode Fuzzy Hash: 06e380a8440d3d394990a2897ef6c35b812df0eb7b3bcce1b054c8a8a708457a
Instruction Fuzzy Hash: 3231E371502219AAEF10EFB4EC49EDE77BCAF06360F14C19AE918A21D0DB38DD458B65

Function 0078BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0078C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0078B6AE,?,?), ref: 0078C9B5
Part of subcall function 0078C998: _wcslen.LIBCMT ref: 0078C9F1
Part of subcall function 0078C998: _wcslen.LIBCMT ref: 0078CA68
Part of subcall function 0078C998: _wcslen.LIBCMT ref: 0078CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0078BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0078BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0078BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0078C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0078C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0078C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0078C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0078C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0078C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0078C382
RegCloseKey.ADVAPI32(00000000), ref: 0078C38F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 804508828b5df939238109621713b01e08dd31ff3f363f632016330e2679c476
Instruction ID: 4760438bca3787422b9bf27c146c2d67bf274239345500546209d8b196929f66
Opcode Fuzzy Hash: 804508828b5df939238109621713b01e08dd31ff3f363f632016330e2679c476
Instruction Fuzzy Hash: A0024C71604200EFD715DF28C895E2ABBE5AF49304F18C59DF84ADB2A2D735EC46CB62

Function 00778195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00778257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00778267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00778273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00778310
SetCurrentDirectoryW.KERNEL32(?), ref: 00778324
SetCurrentDirectoryW.KERNEL32(?), ref: 00778356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0077838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00778395

Strings

*.*, xrefs: 0077839B

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: bebe881c75868d27041e3c3162fa17715d38a61a0568c06c8ffd5fc5e2cac2b8
Instruction ID: 42f70a860f7affdd75cc275b9f9b7614fc0f9937904f7f1a29fe5c270ab7680e
Opcode Fuzzy Hash: bebe881c75868d27041e3c3162fa17715d38a61a0568c06c8ffd5fc5e2cac2b8
Instruction Fuzzy Hash: 22615BB2504305DFCB10EF64C8489AEB3E8FF89354F04891EF99987251DB39E945CB92

Function 0076D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00703AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00703A97,?,?,00702E7F,?,?,?,00000000), ref: 00703AC2

Part of subcall function 0076E199: GetFileAttributesW.KERNEL32(?,0076CF95), ref: 0076E19A

FindFirstFileW.KERNEL32(?,?), ref: 0076D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0076D1DD
MoveFileW.KERNEL32(?,?), ref: 0076D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0076D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0076D237

Part of subcall function 0076D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0076D21C,?,?), ref: 0076D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0076D253
FindClose.KERNEL32(00000000), ref: 0076D264

Strings

\*.*, xrefs: 0076D0CD, 0076D0D6, 0076D0EB

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: f8d051b1eb0e77c1400bea9aacd3a9a72c02386863ad733fab87ce490ba05d05
Instruction ID: feb0ed6acf6718f90a4833e3efe23926dbf0e439ec048a7971d29ac10f7085e1
Opcode Fuzzy Hash: f8d051b1eb0e77c1400bea9aacd3a9a72c02386863ad733fab87ce490ba05d05
Instruction Fuzzy Hash: CA614A31D0110DEFCF15EBA0C9969EEB7B9AF55300F248265E90277192EB386F09CB60

Function 0077ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0077ED91
EmptyClipboard.USER32 ref: 0077ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0077EDAC
CloseClipboard.USER32 ref: 0077EEA3

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: c8002dfe79cd7e2dcbaef3e9eb6a33011cfad66cea5468e791048f963c3307a6
Instruction ID: 14294064a2a05e0d08bbae2edd0f04780d7fdb9cd9b9b35214d9cd5aa6bc1f79
Opcode Fuzzy Hash: c8002dfe79cd7e2dcbaef3e9eb6a33011cfad66cea5468e791048f963c3307a6
Instruction Fuzzy Hash: CB41A035204611EFEB21CF15D848B19BBE5FF48358F14C59AE4198B6A2C779EC42CB90

Function 0076E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 007616C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0076170D
Part of subcall function 007616C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0076173A
Part of subcall function 007616C3: GetLastError.KERNEL32 ref: 0076174A

ExitWindowsEx.USER32(?,00000000), ref: 0076E932

Strings

SeShutdownPrivilege, xrefs: 0076E902
, xrefs: 0076E920
@, xrefs: 0076E925
, xrefs: 0076E95C

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 079c04440e6a7c95b8cd2df4be49e1a9f9625f055606533f0c1287942623d0b4
Instruction ID: 9f25e2d080851bc81d6a98e3f29476e829f5c27ef61817b2797d0698275ee110
Opcode Fuzzy Hash: 079c04440e6a7c95b8cd2df4be49e1a9f9625f055606533f0c1287942623d0b4
Instruction Fuzzy Hash: D301D676610311ABFF5466B49C8AFBB736CAF14750F194426FC03F21D1E5AD6C4085B5

Function 00781204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00781276
WSAGetLastError.WSOCK32 ref: 00781283
bind.WSOCK32(00000000,?,00000010), ref: 007812BA
WSAGetLastError.WSOCK32 ref: 007812C5
closesocket.WSOCK32(00000000), ref: 007812F4
listen.WSOCK32(00000000,00000005), ref: 00781303
WSAGetLastError.WSOCK32 ref: 0078130D
closesocket.WSOCK32(00000000), ref: 0078133C

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 8f522e4cf7f51719736d1c61ebae8fda89f1a642e164cf020f9881336194650c
Instruction ID: 37da988613070407c47d19f69bcceabc482f2d9b5d1b586e6777365a7773e2db
Opcode Fuzzy Hash: 8f522e4cf7f51719736d1c61ebae8fda89f1a642e164cf020f9881336194650c
Instruction Fuzzy Hash: 8D417231600110DFD710EF64C488B69BBE5BF46318F588199D8569F2D6C779ED82CBE1

Function 0076D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00703AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00703A97,?,?,00702E7F,?,?,?,00000000), ref: 00703AC2

Part of subcall function 0076E199: GetFileAttributesW.KERNEL32(?,0076CF95), ref: 0076E19A

FindFirstFileW.KERNEL32(?,?), ref: 0076D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0076D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0076D481
FindClose.KERNEL32(00000000), ref: 0076D498
FindClose.KERNEL32(00000000), ref: 0076D4A1

Strings

\*.*, xrefs: 0076D3F2

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: bebcc7d10633483c99b092a2d339b167474e63d6f23477accd65e55f4a2d7e9e
Instruction ID: 125735dd14e6ee0fb4ea9f7b9513177fa6dc00129240e4896663e87cee17688a
Opcode Fuzzy Hash: bebcc7d10633483c99b092a2d339b167474e63d6f23477accd65e55f4a2d7e9e
Instruction Fuzzy Hash: 2D319071418385DBC715EF60C8958AFBBE8BE91300F448A1DF8D2521D1EB38AE09CB63

Function 0073E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0073E645

Strings

1#IND, xrefs: 0073F83D
1#SNAN, xrefs: 0073F844
1#QNAN, xrefs: 0073F84B
1#INF, xrefs: 0073F852

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 7f91e7f47cd6f49e30a843bc7ebaa561d19931dbd600a95bbb01ccb3d688f8ad
Instruction ID: 9d9daa902bea79abb36f8b91dfd2ae5f40e7c86f02dcce2652c797524472327a
Opcode Fuzzy Hash: 7f91e7f47cd6f49e30a843bc7ebaa561d19931dbd600a95bbb01ccb3d688f8ad
Instruction Fuzzy Hash: D1C23D72E046298FEB25CF28DD447EAB7B5EB44345F1441EAD44DE7282E778AE818F40

Function 0077648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 007764DC
CoInitialize.OLE32(00000000), ref: 00776639
CoCreateInstance.OLE32(0079FCF8,00000000,00000001,0079FB68,?), ref: 00776650
CoUninitialize.OLE32 ref: 007768D4

Strings

.lnk, xrefs: 007764BA, 00776524, 007765E0

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 900b62b842ee9f49f960aa08ceb4cbf3c25b18dc4d1d5596d74b78a54d17793a
Instruction ID: ebd4d1e4603bf9f69932ab79622b584cd6926a378e9246840f51fa2e827e1a02
Opcode Fuzzy Hash: 900b62b842ee9f49f960aa08ceb4cbf3c25b18dc4d1d5596d74b78a54d17793a
Instruction Fuzzy Hash: 6BD14971508601DFC704EF24C885A6BB7E8FF94744F048A6DF5998B291DB74ED05CBA2

Function 007822DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 007822E8

Part of subcall function 0077E4EC: GetWindowRect.USER32(?,?), ref: 0077E504

GetDesktopWindow.USER32 ref: 00782312
GetWindowRect.USER32(00000000), ref: 00782319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00782355
GetCursorPos.USER32(?), ref: 00782381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 007823DF

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 49e40e2bf3317692e4f7b612bfacecb804b2c6db86497b39c270e6be247eeaa5
Instruction ID: 3f977c73c3222014573ceeb824631c9b8b3aedc9676fd8ce97cb19739a2e294c
Opcode Fuzzy Hash: 49e40e2bf3317692e4f7b612bfacecb804b2c6db86497b39c270e6be247eeaa5
Instruction Fuzzy Hash: 5231E372544315AFCB21EF54C849F5BB7E9FF84310F00491AF98597182DB38E90ACBA6

Function 00779B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00779B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00779C8B

Part of subcall function 00773874: GetInputState.USER32 ref: 007738CB
Part of subcall function 00773874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00773966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00779BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00779C75

Strings

*.*, xrefs: 00779B5D

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: abd8a1e5e919bd85455f54f75b3aa69060ea131c009424261e47b343615c8ccd
Instruction ID: 3efcd79092053ab820623eea2da6d5a78028fcf5e1166e10cfcd32ef3e277b10
Opcode Fuzzy Hash: abd8a1e5e919bd85455f54f75b3aa69060ea131c009424261e47b343615c8ccd
Instruction Fuzzy Hash: B84161B1901209EFDF15DF74C989AEEBBF8EF05350F248156E509A2191DB389E84CF60

Function 0071997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00719BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00719BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00719A4E
GetSysColor.USER32(0000000F), ref: 00719B23
SetBkColor.GDI32(?,00000000), ref: 00719B36

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: aa5d306bc4fb6b25d84285639c2d718692fc1179688aaf66f75672815ab4662d
Instruction ID: fa9fb979b4b9a8abd83038b5dbaaf2dcdb27c371972ee2d383b591a3d6ce0d24
Opcode Fuzzy Hash: aa5d306bc4fb6b25d84285639c2d718692fc1179688aaf66f75672815ab4662d
Instruction Fuzzy Hash: 98A12C70208444FEE7299A3CAC7DDFB26ADDF46341B158109FA02C66D1CA6DDD8BC276

Function 00781806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0078304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0078307A
Part of subcall function 0078304E: _wcslen.LIBCMT ref: 0078309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0078185D
WSAGetLastError.WSOCK32 ref: 00781884
bind.WSOCK32(00000000,?,00000010), ref: 007818DB
WSAGetLastError.WSOCK32 ref: 007818E6
closesocket.WSOCK32(00000000), ref: 00781915

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 042b1b62d62d0aacc20682e75686a9320eaefb0aba0dad433a7c534ddbedcaf3
Instruction ID: 6b340168424aa650cb88e27bc7bee981ad4dfabc3ca856a51c8f7e1cbda0bf49
Opcode Fuzzy Hash: 042b1b62d62d0aacc20682e75686a9320eaefb0aba0dad433a7c534ddbedcaf3
Instruction Fuzzy Hash: AB51B471A40200DFDB10AF24C88AF6A77E5AB45718F488198F9059F3D3C779AD82CBE1

Function 00791C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00791CC0
IsWindowEnabled.USER32 ref: 00791CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00791CDB
IsIconic.USER32 ref: 00791CE9
IsZoomed.USER32 ref: 00791CF7

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: c42952b9a90fdeaa5624606434c0e1af7c9e84eeb309eb00552d85313c89afd0
Instruction ID: 609fdeaf0c89cd65391bff04e3da9645145d3aa290809b97a760acc8e2562fce
Opcode Fuzzy Hash: c42952b9a90fdeaa5624606434c0e1af7c9e84eeb309eb00552d85313c89afd0
Instruction Fuzzy Hash: A221F9317402029FDB218F1AE844B267BE5EF86314F59C059E846CB351CB79EC42CBA4

Function 00708060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

ERCP, xrefs: 0070813C
VUUU, xrefs: 007083E8
VUUU, xrefs: 0070843C
VUUU, xrefs: 00745DF0
VUUU, xrefs: 007083FA

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 6be77e76cd9be841cb72e7f69f76ca1cdaae1610947962009d2fb982f0aa63b2
Instruction ID: 100ad4d40d3c9ab1b6cf53aba296b0d8d4313d968d405f65fac21772c694f171
Opcode Fuzzy Hash: 6be77e76cd9be841cb72e7f69f76ca1cdaae1610947962009d2fb982f0aa63b2
Instruction Fuzzy Hash: 0BA29270E0061ACBDF64CF58C8807ADB7B1BF55314F2482AAE855A7285EB789D81CF52

Function 00768298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 007682AA

Strings

tb|, xrefs: 007684F4
(, xrefs: 007682F0
|, xrefs: 007682DA

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($tb|$|
API String ID: 1659193697-2513361831
Opcode ID: 25fea64867c459d61368ee22557ae0cf043a39747de7ca1b856723424c3ad11d
Instruction ID: d839e61fd71fa095c30abd39204c39127c505eeced341db5944735f6a982f892
Opcode Fuzzy Hash: 25fea64867c459d61368ee22557ae0cf043a39747de7ca1b856723424c3ad11d
Instruction Fuzzy Hash: 06323574A00605DFCB68CF59C080A6AB7F0FF48710B15C56EE89ADB3A1EB74E981CB45

Function 0078A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0078A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0078A6BA

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

Process32NextW.KERNEL32(00000000,?), ref: 0078A79C
CloseHandle.KERNEL32(00000000), ref: 0078A7AB

Part of subcall function 0071CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00743303,?), ref: 0071CE8A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: a5cf4238288e9e0acb03107453002b9801108889308967cf965d0cc4bcba5f5b
Instruction ID: 4807bf1d1ceb7b55dbac27bd87dd44c8d010b0e13f8b405c53724b2201fb8081
Opcode Fuzzy Hash: a5cf4238288e9e0acb03107453002b9801108889308967cf965d0cc4bcba5f5b
Instruction Fuzzy Hash: 495130B1508301EFD710EF24C88AA5BBBE8FF89754F408A1DF58597291EB74E944CB92

Function 0076AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0076AAAC
SetKeyboardState.USER32(00000080), ref: 0076AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0076AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0076AB88

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 1eb86e18d7c6f1987e6ed55a673383b7b7c89f8a0e597056ba97414b236ac0da
Instruction ID: 42fe0a5fa1f3c6f8a3b8ac98880bc3ab1f366b9e225c8904d3acda11500f318b
Opcode Fuzzy Hash: 1eb86e18d7c6f1987e6ed55a673383b7b7c89f8a0e597056ba97414b236ac0da
Instruction Fuzzy Hash: 4431EBB0A40248BEFF35CA65CC05BFE77A6AB45310F04421BE98A665D1D37D8D81CB66

Function 0073BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0073BB7F

Part of subcall function 007329C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0073D7D1,00000000,00000000,00000000,00000000,?,0073D7F8,00000000,00000007,00000000,?,0073DBF5,00000000), ref: 007329DE
Part of subcall function 007329C8: GetLastError.KERNEL32(00000000,?,0073D7D1,00000000,00000000,00000000,00000000,?,0073D7F8,00000000,00000007,00000000,?,0073DBF5,00000000,00000000), ref: 007329F0

GetTimeZoneInformation.KERNEL32 ref: 0073BB91
WideCharToMultiByte.KERNEL32(00000000,?,007D121C,000000FF,?,0000003F,?,?), ref: 0073BC09
WideCharToMultiByte.KERNEL32(00000000,?,007D1270,000000FF,?,0000003F,?,?,?,007D121C,000000FF,?,0000003F,?,?), ref: 0073BC36

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 4f855be62927f3eb91577ce1200b51540572d501eee4e527aa7ebec752797b14
Instruction ID: ea0c7f12678b13093733d9737b27728f8d52d1096aa865b8c7fdd62a62a0dcc0
Opcode Fuzzy Hash: 4f855be62927f3eb91577ce1200b51540572d501eee4e527aa7ebec752797b14
Instruction Fuzzy Hash: 5731C6B0A04215EFDB11DF69DC8053DBBB8FF45350B54826BE150D72A2D739AE41CB64

Function 0077CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0077CE89
GetLastError.KERNEL32(?,00000000), ref: 0077CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0077CEFE

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: ae832734f475c007cd2a6db3b87185dde56a0028015bedffc2715bbb11951ada
Instruction ID: eb442695a758b6e0d1b0ca8c09716d4c06b4c511bac1d311c00054659091bc36
Opcode Fuzzy Hash: ae832734f475c007cd2a6db3b87185dde56a0028015bedffc2715bbb11951ada
Instruction Fuzzy Hash: 4121EDB25003059BEF32CFA5C948BA677F8EB04384F10841EE54A92151E7B8EE458B64

Function 00775C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00775CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00775D17
FindClose.KERNEL32(?), ref: 00775D5F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: c45f60f8c8f2cc5c9cf7187a1c9956a82042bf046c7bb5b668183e311387d73f
Instruction ID: 8f557dc3466b4137d5828b3509a4e231b77cfb5664af1cf9e1917bb7f0647925
Opcode Fuzzy Hash: c45f60f8c8f2cc5c9cf7187a1c9956a82042bf046c7bb5b668183e311387d73f
Instruction Fuzzy Hash: 98518874604A01DFCB14CF28C498A96B7E4FF09314F14865EE95A8B3A1CB78FC04CB91

Function 00732622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0073271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00732724
UnhandledExceptionFilter.KERNEL32(?), ref: 00732731

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e30e88d4cdefeeae84418ad91618db82d3ca05cfeb30840254b8d6f3f943f7e9
Instruction ID: 3771fb082489681d368f5fbca104276b4c1389ecfe6919453e10a5fd45f68121
Opcode Fuzzy Hash: e30e88d4cdefeeae84418ad91618db82d3ca05cfeb30840254b8d6f3f943f7e9
Instruction Fuzzy Hash: 8731B774911228ABCB21DF64DC8979DBBB8BF08310F5081DAE51CA7261E7349F818F95

Function 007751CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007751DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00775238
SetErrorMode.KERNEL32(00000000), ref: 007752A1

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: ff717a0f2dc84cfc14f59e66a44e2b9169e6db2cba6507509c17b27d06813a40
Instruction ID: 621aca8f941c331f89beb534dabfc33664963163c32dcb3c7e2efb862c954dcc
Opcode Fuzzy Hash: ff717a0f2dc84cfc14f59e66a44e2b9169e6db2cba6507509c17b27d06813a40
Instruction Fuzzy Hash: 42317F75A00518DFDB00DF54D888EADBBF4FF08314F088099E809AB3A2CB35E856CB51

Function 007616C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0071FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00720668
Part of subcall function 0071FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00720685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0076170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0076173A
GetLastError.KERNEL32 ref: 0076174A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 554c8bbb3e2b6d80b98e56fcef335a52165d07fb7070568baf783e6e57366c85
Instruction ID: ed699c9636141066ca403db2def240ebcd55c35581e976961a8f8a71987fa6cb
Opcode Fuzzy Hash: 554c8bbb3e2b6d80b98e56fcef335a52165d07fb7070568baf783e6e57366c85
Instruction Fuzzy Hash: 9411C1B2500304AFD7189F58EC8ADAAB7B9EB04714B24852EE45653281EB74FC418B24

Function 0076D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0076D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0076D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0076D650

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: bb98524314c2a037e66ebfea2f7b54807d89789ff4faa0a5565de0600314b546
Instruction ID: c72eb4ad336891608dff1efd019a5340a8fffdb25502bb4dcaa61d936398036d
Opcode Fuzzy Hash: bb98524314c2a037e66ebfea2f7b54807d89789ff4faa0a5565de0600314b546
Instruction Fuzzy Hash: 4F117C71E01228BBDB208F94DC45FAFBBBCEB45B50F108112F904E7290C2744A018BA5

Function 00761663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0076168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 007616A1
FreeSid.ADVAPI32(?), ref: 007616B1

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: b51c31df177adaf2c17a87f3fa3e33aaca8ff2b8a7e1f5cef9605a1e06c66630
Instruction ID: ac7549ccc5c8ee9f817959462fdab2b6159ebb7ed2265c6e1d3a68305cadfecd
Opcode Fuzzy Hash: b51c31df177adaf2c17a87f3fa3e33aaca8ff2b8a7e1f5cef9605a1e06c66630
Instruction Fuzzy Hash: 0CF0F475950309FBDF00DFE4DD89AAEBBBCEB08604F508565EA01E2191E778AA448A54

Function 00724CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(007328E9,?,00724CBE,007328E9,007C88B8,0000000C,00724E15,007328E9,00000002,00000000,?,007328E9), ref: 00724D09
TerminateProcess.KERNEL32(00000000,?,00724CBE,007328E9,007C88B8,0000000C,00724E15,007328E9,00000002,00000000,?,007328E9), ref: 00724D10
ExitProcess.KERNEL32 ref: 00724D22

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c4c23de33297f6b4fd376916e4c73c87be7253b85888fcf766d055e50fe0a77f
Instruction ID: ad93dfd98e904bbaec83f1b5e3db5a3aada71c04eb7a910d579deacfa29a106d
Opcode Fuzzy Hash: c4c23de33297f6b4fd376916e4c73c87be7253b85888fcf766d055e50fe0a77f
Instruction Fuzzy Hash: E9E0B631100558FFCF22AF64EE0AA583B69EB41B81F108019FD098B122CB3DDD42CA95

Function 0075D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0075D28C

Strings

X64, xrefs: 0075D2A8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 884a0ae5beef84997a172846a125f8bfdfae8039c52ab53cc3ea629b45af8732
Instruction ID: 289dc7a90460b9b40cd78efbc4d810168c1ad9b355f64e78208a615faadabef4
Opcode Fuzzy Hash: 884a0ae5beef84997a172846a125f8bfdfae8039c52ab53cc3ea629b45af8732
Instruction Fuzzy Hash: 98D0C9B480111DEECFA0CB90DC88DDDB37CBB04305F104152F506A2140DBB899498F20

Function 0072CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 283849418078bdb791a0669487d4446f73bbead05e4b0fc4b7b59ea055573895
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 0C024D72E002299FDF15CFA9D9806ADFBF1EF58314F25816AD919E7380D734AA41CB90

Function 0070CAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

p#}, xrefs: 0070CF7F
Variable is not of type 'Object'., xrefs: 00750C40

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#}
API String ID: 0-2137504428
Opcode ID: c735f0e2f4180581b16970e3f78536003553dab3c1a7e52466dc1a53e3abd4e9
Instruction ID: 048f1b3eb16062c7b74ce798af5ce909c8943028fe5ae55286ce03ae5f3e36ae
Opcode Fuzzy Hash: c735f0e2f4180581b16970e3f78536003553dab3c1a7e52466dc1a53e3abd4e9
Instruction Fuzzy Hash: 3732B070900209DBDF15DF94C885AEDB7F5FF05304F248259E806AB2C2DB79AE4ACB61

Function 007768EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00776918
FindClose.KERNEL32(00000000), ref: 00776961

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: d118233975200738e78fa8c11ec0edb7117777f3b4f1a8b1a598c65dc3d161e8
Instruction ID: 7bd91e504886c4c19ed825daf751acda940c09540675a6fb4bf825ac0dfd378e
Opcode Fuzzy Hash: d118233975200738e78fa8c11ec0edb7117777f3b4f1a8b1a598c65dc3d161e8
Instruction Fuzzy Hash: AD11AF71604601DFDB10CF29C488A16BBE0FF84328F04C69DE5698B2A6CB34FC05CB91

Function 007737B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00784891,?,?,00000035,?), ref: 007737E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00784891,?,?,00000035,?), ref: 007737F4

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 0e3abaa2a933768a0ce86b2267a6cd23dfe3904724397792abb19bffd6c99777
Instruction ID: a1e40ddb0c13ca78dc4b011687fe583e3844748f45aef3a2f85fbb754d15ea39
Opcode Fuzzy Hash: 0e3abaa2a933768a0ce86b2267a6cd23dfe3904724397792abb19bffd6c99777
Instruction Fuzzy Hash: 1BF0E5B16052286AEF2027768C8DFEB3BAEEFC47A1F004265F509D2281DA749945C6F0

Function 007610BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007611FC), ref: 007610D4
CloseHandle.KERNEL32(?,?,007611FC), ref: 007610E9

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: a4520e7dfd1e88d6b8501064a0f532505d54c851fe337d07ba3fbe534e31ca60
Instruction ID: b9d0b160cf9e949a0ec485d8914fa797fbeccec56b43463b988fbe4108d3a7e4
Opcode Fuzzy Hash: a4520e7dfd1e88d6b8501064a0f532505d54c851fe337d07ba3fbe534e31ca60
Instruction Fuzzy Hash: DBE0BF72018610EEEB262B55FD09EB777A9EB04310F14C82EF5A6804B1DB666CE1DB54

Function 0070BF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

p#}, xrefs: 007507CE

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: BuffCharUpper
String ID: p#}
API String ID: 3964851224-1001245602
Opcode ID: 264924a6e4a262b08ca416508851da8e63c8d263fb6644983d038d11df6d3a65
Instruction ID: a9bbdcc2d1c8e26963cca447616ef4da98d287bfc6bdc50b6e80c060eeed766a
Opcode Fuzzy Hash: 264924a6e4a262b08ca416508851da8e63c8d263fb6644983d038d11df6d3a65
Instruction Fuzzy Hash: 48A27C70608341DFD711CF28C484B6AB7E1BF89304F148A6DE99A9B392D779EC45CB92

Function 0073676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00736766,?,?,00000008,?,?,0073FEFE,00000000), ref: 00736998

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 742971870c6ed0ba55785ee8140d278427fe088dc443383e6509e39fe0beb8fc
Instruction ID: cc0fab2389ba7a45aba82b7298f0f6e2e47c4a0176ade43954df9bd85759e910
Opcode Fuzzy Hash: 742971870c6ed0ba55785ee8140d278427fe088dc443383e6509e39fe0beb8fc
Instruction Fuzzy Hash: F8B12C71610609AFE715CF28C48ABA57BE0FF45364F25C658E8D9CF2A2C739E991CB40

Function 0071B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0075851F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2d5890819bfb61315dbaed9570a8b5346a04576adc1ad1e7091cf6b19e1424e5
Instruction ID: 8a22d354e55fb25df1c29329fa619ea91b91d093520811e22832821f57431c5e
Opcode Fuzzy Hash: 2d5890819bfb61315dbaed9570a8b5346a04576adc1ad1e7091cf6b19e1424e5
Instruction Fuzzy Hash: 5C125F71900229DFDB54CF58C8806EEB7F5FF48710F14819AE849EB291EB789E85CB91

Function 0077EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0077EABD

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 3fde775c4e798cde66a96bd8388b2977fc0571869e3ec04f7f9321c070f46c63
Instruction ID: 963e8b5201a36433b32d196d83a6c41dc4fbcdea0dad3a3d7ff789e3946169ec
Opcode Fuzzy Hash: 3fde775c4e798cde66a96bd8388b2977fc0571869e3ec04f7f9321c070f46c63
Instruction Fuzzy Hash: 51E01A32200204DFCB10EF59D808E9AB7E9AF9D7A0F01C456FC49C7291DA78A8418B91

Function 007209D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,007203EE), ref: 007209DA

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 50e665e8b219447885da1c83d0cba2adfc3a77e7b8bfb80f86bbf2b1baa65842
Instruction ID: d703a797928342138d5546fbbdaaa013681d218f7d386626b474f0fcaf9e199e
Opcode Fuzzy Hash: 50e665e8b219447885da1c83d0cba2adfc3a77e7b8bfb80f86bbf2b1baa65842
Instruction Fuzzy Hash:

Function 0072781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0072798B

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 165eaa8e1ab9d77404ab4fa4c76b1a4ec884c5ed9837e2529eb17e5a490c76c4
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 5851797160C7759BDB3C8578BB9E7BE23999B12300F18050DE9C2DB282C61DEE81D356

Function 00772046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&}, xrefs: 00772053

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID: 0&}
API String ID: 0-910209575
Opcode ID: 7de6beec07c6d8d7f6ac8e9adef1ee298ef86a72ddede826677d7c49c78fd660
Instruction ID: 320f1ef74768164018f07010d17f4718938b5a3e8f27150fa66dcb2e42e8871b
Opcode Fuzzy Hash: 7de6beec07c6d8d7f6ac8e9adef1ee298ef86a72ddede826677d7c49c78fd660
Instruction Fuzzy Hash: 8621A8327216118BDB28CF79C81267E73E5A764310F19CA2EE4A7C37D1DE39A905C794

Function 00736DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c9806b3b2e628cede65ba276a0613d13e68530c5af9a3ae3489e316115d760
Instruction ID: 4b73cb52583a0e08dcf4ed86eba3e5c74ce06cbc43148dfc147f4fb302c679d8
Opcode Fuzzy Hash: 63c9806b3b2e628cede65ba276a0613d13e68530c5af9a3ae3489e316115d760
Instruction Fuzzy Hash: 3E321362D29F414DE72B9638C8223356649AFB73C5F15D727E81AB5DA7EB2DC4C38100

Function 0071CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14620c4cd04780aee4a01c3d0fe6bfe60cfdfc753956e444d6a869885518e540
Instruction ID: 9c9131c7025a3e0b35a6a48707e85508252542f51c2fdb0c1c25cb4542bbc540
Opcode Fuzzy Hash: 14620c4cd04780aee4a01c3d0fe6bfe60cfdfc753956e444d6a869885518e540
Instruction Fuzzy Hash: 3E321731A003058FDF26CEA8C4947FD7BA1EB45302F28856ADC49DB291E67CDD89DB94

Function 00707920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60564567fc2284adf9077a15653220e43e1cc6ccfc60d70abdfeae743ae8aca9
Instruction ID: 4f6cd95265e02e5a5f839d70245a26f32ea1e691ca29f4e7e06a330a68611c58
Opcode Fuzzy Hash: 60564567fc2284adf9077a15653220e43e1cc6ccfc60d70abdfeae743ae8aca9
Instruction Fuzzy Hash: A822A2B0E04609DFDF14CF68D845AAEB7F5FF44300F148629E816AB292EB39AD55CB50

Function 007091C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a2b164484f4ed6d338d875a90fec392c8b8df5123fb95e353e1dcf072f9e4b0
Instruction ID: 58ab2b403b317675b5b269d2bcd297ab9d548e2c7c08a8edbd9077277ce9e2f4
Opcode Fuzzy Hash: 3a2b164484f4ed6d338d875a90fec392c8b8df5123fb95e353e1dcf072f9e4b0
Instruction Fuzzy Hash: A502B5B0E00205EFDB04DF64D885AAEB7F1FF44310F118169E9169B2D1EB39EA54CB91

Function 00739EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6718357f39a56a337ad008e52f900599ed5969781df131e7bc9f6f803e7a467
Instruction ID: a87d8f15dd41c5e724097f94188f9ce209d2d377a6f7d6dccee598f638c23158
Opcode Fuzzy Hash: f6718357f39a56a337ad008e52f900599ed5969781df131e7bc9f6f803e7a467
Instruction Fuzzy Hash: 48B1E020D2AF414DD6239A398832336F65CAFFB6D5F91D71BFC6674D22EB2686834140

Function 00721C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 9e92e5e231fd5340c43ea086814f31d730e69c3155d06a0e70a2c8fdb5d3f7ba
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: E99189726090F34ADB29463EA57403EFFE17A623A235A079DD4F2CB1C5FE28D954D620

Function 007219B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 90f2874333acf5bd2a1fbb827fbe6dbfdf70eb9bcaa6ace4aaad94c20f467a56
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: D19156722090F34EDB2D467AA57403DFFF16AA23A139A47AED4F2CA1C1FD28D554D620

Function 00727A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c6d8d4cde9b076fced345da3ed7dc163980f80be900d0e73b338a8748e79dd
Instruction ID: 3d3f022a019d6df7ebd77cd6229e76a38abb47d207232bcdc07625e057a0a8c7
Opcode Fuzzy Hash: d5c6d8d4cde9b076fced345da3ed7dc163980f80be900d0e73b338a8748e79dd
Instruction Fuzzy Hash: 35616DB120877597DF3C592CBF95BBE23A8DF41710F14491DE842DB281D51D9E81C366

Function 00727CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511598f748292f9402bae3e4fb82f84f6e1e33f85692b9c35e32222677f4e0fe
Instruction ID: e6b734315dd8e2902d8fd282118954adbe63482a8e9fef535086cd64f0bfef7e
Opcode Fuzzy Hash: 511598f748292f9402bae3e4fb82f84f6e1e33f85692b9c35e32222677f4e0fe
Instruction Fuzzy Hash: 3F618B75B0873997DE3C4A287B55BBF2394EF42700F10095EE842DB281DA1EAD42C266

Function 00721706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 311e3a80d7cf7b6cf34c321ec8613f82ab228fab317144c951525ed5c77d4272
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 938176726090F34ADB6D423A957443EFFE17AA23B135A07ADD4F2CB1C1EE28D654D620

Function 00782ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00782B30
DeleteObject.GDI32(00000000), ref: 00782B43
DestroyWindow.USER32 ref: 00782B52
GetDesktopWindow.USER32 ref: 00782B6D
GetWindowRect.USER32(00000000), ref: 00782B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00782CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00782CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00782CF8
GetClientRect.USER32(00000000,?), ref: 00782D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00782D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00782D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00782D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00782D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00782D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00782D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00782DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00782DA8
GlobalFree.KERNEL32(00000000), ref: 00782DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00782DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0079FC38,00000000), ref: 00782DDB
GlobalFree.KERNEL32(00000000), ref: 00782DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00782E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00782E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00782E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0078303F

Strings

static, xrefs: 00782D3A, 00782E91
, xrefs: 00782FC5
AutoIt v3, xrefs: 00782CF2
DISPLAY, xrefs: 00782EA2

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 4c25efc3439d027a08ec68ebdb2c82ab6cab3d2b127d1ff3a31e6c967418cf19
Instruction ID: ae79f387ba1d755d0cfbec3f85f8c3bd469552c3a74df14bfc4b1d02c544d31c
Opcode Fuzzy Hash: 4c25efc3439d027a08ec68ebdb2c82ab6cab3d2b127d1ff3a31e6c967418cf19
Instruction Fuzzy Hash: 7B027E71900204EFDB15DFA4CC89EAE7BB9FF48715F008159F915AB2A1DB78AD02CB64

Function 007970D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0079712F
GetSysColorBrush.USER32(0000000F), ref: 00797160
GetSysColor.USER32(0000000F), ref: 0079716C
SetBkColor.GDI32(?,000000FF), ref: 00797186
SelectObject.GDI32(?,?), ref: 00797195
InflateRect.USER32(?,000000FF,000000FF), ref: 007971C0
GetSysColor.USER32(00000010), ref: 007971C8
CreateSolidBrush.GDI32(00000000), ref: 007971CF
FrameRect.USER32(?,?,00000000), ref: 007971DE
DeleteObject.GDI32(00000000), ref: 007971E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00797230
FillRect.USER32(?,?,?), ref: 00797262
GetWindowLongW.USER32(?,000000F0), ref: 00797284

Part of subcall function 007973E8: GetSysColor.USER32(00000012), ref: 00797421
Part of subcall function 007973E8: SetTextColor.GDI32(?,?), ref: 00797425
Part of subcall function 007973E8: GetSysColorBrush.USER32(0000000F), ref: 0079743B
Part of subcall function 007973E8: GetSysColor.USER32(0000000F), ref: 00797446
Part of subcall function 007973E8: GetSysColor.USER32(00000011), ref: 00797463
Part of subcall function 007973E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00797471
Part of subcall function 007973E8: SelectObject.GDI32(?,00000000), ref: 00797482
Part of subcall function 007973E8: SetBkColor.GDI32(?,00000000), ref: 0079748B
Part of subcall function 007973E8: SelectObject.GDI32(?,?), ref: 00797498
Part of subcall function 007973E8: InflateRect.USER32(?,000000FF,000000FF), ref: 007974B7
Part of subcall function 007973E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007974CE
Part of subcall function 007973E8: GetWindowLongW.USER32(00000000,000000F0), ref: 007974DB

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: e97017cb1be6dbd64f59041d0f991a902b38a4b3278cb94c9e89671baa0f6d42
Instruction ID: b344b4b66680d151031df0f73913cd2bc26e6ff2b6361f9b583a27f5decda50c
Opcode Fuzzy Hash: e97017cb1be6dbd64f59041d0f991a902b38a4b3278cb94c9e89671baa0f6d42
Instruction Fuzzy Hash: 44A1BF72018305EFDF069F64EC48A6B7BB9FF88320F104A1AF962961E1D738E945CB55

Function 00718D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00718E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00756AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00756AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00756F43

Part of subcall function 00718F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00718BE8,?,00000000,?,?,?,?,00718BBA,00000000,?), ref: 00718FC5

SendMessageW.USER32(?,00001053), ref: 00756F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00756F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00756FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00756FB7

Strings

0, xrefs: 00756DCF

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: e1c9e46a47394e0047ab696072fa383ac8e7700f5853f4d226a94a96a7f2ee39
Instruction ID: 893f710157cf98e5a606125bff6b5704404e39c6e1d6f860f1e4c991e740cabe
Opcode Fuzzy Hash: e1c9e46a47394e0047ab696072fa383ac8e7700f5853f4d226a94a96a7f2ee39
Instruction Fuzzy Hash: 2C12C170601241EFDB25CF28C854BE5B7F1FB45302F948469F8858B2A1CB79EC9ACB91

Function 00782711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0078273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0078286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 007828A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 007828B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00782900
GetClientRect.USER32(00000000,?), ref: 0078290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00782955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00782964
GetStockObject.GDI32(00000011), ref: 00782974
SelectObject.GDI32(00000000,00000000), ref: 00782978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00782988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00782991
DeleteDC.GDI32(00000000), ref: 0078299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 007829C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 007829DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00782A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00782A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00782A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00782A77
GetStockObject.GDI32(00000011), ref: 00782A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00782A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00782A97

Strings

static, xrefs: 0078294F, 00782A71
AutoIt v3, xrefs: 007828F8
msctls_progress32, xrefs: 00782A13
DISPLAY, xrefs: 0078295A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 31a38660a15cb58638a59bf39fe8f93d5262362d0cb8aee0e21cea4945aaf31a
Instruction ID: 832600789a0975322ede65570ea71c65c5f9dd17dd9df425e40f551ce601c11f
Opcode Fuzzy Hash: 31a38660a15cb58638a59bf39fe8f93d5262362d0cb8aee0e21cea4945aaf31a
Instruction Fuzzy Hash: 70B15BB1A40205BFEB14DFA8DC49EAE7BB9EB08711F008115FA15E72D1D778AD41CBA4

Function 00774ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00774AED
GetDriveTypeW.KERNEL32(?,0079CB68,?,\\.\,0079CC08), ref: 00774BCA
SetErrorMode.KERNEL32(00000000,0079CB68,?,\\.\,0079CC08), ref: 00774D36

Strings

Unknown, xrefs: 00774BED, 00774C83
SAS, xrefs: 00774CC9
Fibre, xrefs: 00774CAD
SCSI, xrefs: 00774C8A
RAMDisk, xrefs: 00774BF4
\\.\, xrefs: 00774B3F
iSCSI, xrefs: 00774CC2
FileBackedVirtual, xrefs: 00774CEC
MMC, xrefs: 00774CDE
SATA, xrefs: 00774CD0
SSA, xrefs: 00774CA6
Removable, xrefs: 00774C10, 00774C15
ATAPI, xrefs: 00774C91
1394, xrefs: 00774C9F
CDROM, xrefs: 00774BFB
Network, xrefs: 00774C02
Virtual, xrefs: 00774CE5
SSD, xrefs: 00774C4A
Fixed, xrefs: 00774C09
RAID, xrefs: 00774CBB
ATA, xrefs: 00774C98
PhysicalDrive, xrefs: 00774B76
USB, xrefs: 00774CB4

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: d08352333028dab6b4e0b3cf336cc7e91b56bea43c5fbc8cd213e0081b3f1c80
Instruction ID: 09d7111138d36ef658c7258f6089b370be6a6a9d6f2c87a2a59a1ade79b7f7b7
Opcode Fuzzy Hash: d08352333028dab6b4e0b3cf336cc7e91b56bea43c5fbc8cd213e0081b3f1c80
Instruction Fuzzy Hash: 7261ADB1705105DBCF15DB28CAD6E69B7F0AB04380B24C52DE80AAB692DB3DED41DB61

Function 007973E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00797421
SetTextColor.GDI32(?,?), ref: 00797425
GetSysColorBrush.USER32(0000000F), ref: 0079743B
GetSysColor.USER32(0000000F), ref: 00797446
CreateSolidBrush.GDI32(?), ref: 0079744B
GetSysColor.USER32(00000011), ref: 00797463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00797471
SelectObject.GDI32(?,00000000), ref: 00797482
SetBkColor.GDI32(?,00000000), ref: 0079748B
SelectObject.GDI32(?,?), ref: 00797498
InflateRect.USER32(?,000000FF,000000FF), ref: 007974B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007974CE
GetWindowLongW.USER32(00000000,000000F0), ref: 007974DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0079752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00797554
InflateRect.USER32(?,000000FD,000000FD), ref: 00797572
DrawFocusRect.USER32(?,?), ref: 0079757D
GetSysColor.USER32(00000011), ref: 0079758E
SetTextColor.GDI32(?,00000000), ref: 00797596
DrawTextW.USER32(?,007970F5,000000FF,?,00000000), ref: 007975A8
SelectObject.GDI32(?,?), ref: 007975BF
DeleteObject.GDI32(?), ref: 007975CA
SelectObject.GDI32(?,?), ref: 007975D0
DeleteObject.GDI32(?), ref: 007975D5
SetTextColor.GDI32(?,?), ref: 007975DB
SetBkColor.GDI32(?,?), ref: 007975E5

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 305553ce8ade6f661611dab583439d70a8bf573f170d3a3740622e01ad8624d9
Instruction ID: 00cdc8b9b4dd8f046598eed0571f9d0f134e503b87fe9abfbd410973840a4b12
Opcode Fuzzy Hash: 305553ce8ade6f661611dab583439d70a8bf573f170d3a3740622e01ad8624d9
Instruction Fuzzy Hash: 98616D72900218AFDF059FA4DC49EEEBFB9EB08320F118116F915AB2A1D7789951CF94

Function 00790FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00791128
GetDesktopWindow.USER32 ref: 0079113D
GetWindowRect.USER32(00000000), ref: 00791144
GetWindowLongW.USER32(?,000000F0), ref: 00791199
DestroyWindow.USER32(?), ref: 007911B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 007911ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0079120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0079121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00791232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00791245
IsWindowVisible.USER32(00000000), ref: 007912A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 007912BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 007912D0
GetWindowRect.USER32(00000000,?), ref: 007912E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0079130E
GetMonitorInfoW.USER32(00000000,?), ref: 00791328
CopyRect.USER32(?,?), ref: 0079133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 007913AA

Strings

tooltips_class32, xrefs: 007911E6
(, xrefs: 0079131B
0, xrefs: 007910D3

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 03aaf519fb8df9674251b6c6133ed048d1a174ee8f52e21014430a5e9fd355f1
Instruction ID: b411a68145557f0fb3aa6d5eb1e26dd316678a9da65abf54db09ce1437ba62a5
Opcode Fuzzy Hash: 03aaf519fb8df9674251b6c6133ed048d1a174ee8f52e21014430a5e9fd355f1
Instruction Fuzzy Hash: FFB19D71604341EFDB00DF64D888B6ABBE4FF88350F408919F9999B2A1CB75E855CB92

Function 00790241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007902E5
_wcslen.LIBCMT ref: 0079031F
_wcslen.LIBCMT ref: 00790389
_wcslen.LIBCMT ref: 007903F1
_wcslen.LIBCMT ref: 00790475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007904C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00790504

Part of subcall function 0071F9F2: _wcslen.LIBCMT ref: 0071F9FD

Part of subcall function 0076223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00762258
Part of subcall function 0076223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0076228A

Strings

ISSELECTED, xrefs: 007904DD
DESELECT, xrefs: 0079059C
GETSELECTEDCOUNT, xrefs: 00790470, 0079048B
VIEWCHANGE, xrefs: 00790675
GETITEMCOUNT, xrefs: 00790316, 00790337
SELECTALL, xrefs: 00790515
GETTEXT, xrefs: 007903EC, 00790407
GETSUBITEMCOUNT, xrefs: 00790384, 0079039F
GETSELECTED, xrefs: 007905E1
FINDITEM, xrefs: 00790627
SELECTCLEAR, xrefs: 0079052D
SELECTINVERT, xrefs: 0079057E
SELECT, xrefs: 00790548

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: fd16477f69eba1fa51a982b03cdd04e2e518095cc1410c2b46471d76df2f3963
Instruction ID: a2e0f307302b5f6fb1255b00180d06909838b4c2a5d395878edb3e09db30cb7a
Opcode Fuzzy Hash: fd16477f69eba1fa51a982b03cdd04e2e518095cc1410c2b46471d76df2f3963
Instruction Fuzzy Hash: E0E1B031218201CFCB14DF24D95592AB7E6BFC8714F144A6CF8969B3A1DB38ED45CB91

Function 00718891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00718968
GetSystemMetrics.USER32(00000007), ref: 00718970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0071899B
GetSystemMetrics.USER32(00000008), ref: 007189A3
GetSystemMetrics.USER32(00000004), ref: 007189C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 007189E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 007189F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00718A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00718A3C
GetClientRect.USER32(00000000,000000FF), ref: 00718A5A
GetStockObject.GDI32(00000011), ref: 00718A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00718A81

Part of subcall function 0071912D: GetCursorPos.USER32(?), ref: 00719141
Part of subcall function 0071912D: ScreenToClient.USER32(00000000,?), ref: 0071915E
Part of subcall function 0071912D: GetAsyncKeyState.USER32(00000001), ref: 00719183
Part of subcall function 0071912D: GetAsyncKeyState.USER32(00000002), ref: 0071919D

SetTimer.USER32(00000000,00000000,00000028,007190FC), ref: 00718AA8

Strings

AutoIt v3 GUI, xrefs: 00718A20

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 3033fec4ac36707eb8644433804fc2ed24c266d5110bccf0c41201f18d3afc47
Instruction ID: 0019bf22b2e6ba8e09dcba57f74bd0a5c1511495fb56c1680de606944484b61b
Opcode Fuzzy Hash: 3033fec4ac36707eb8644433804fc2ed24c266d5110bccf0c41201f18d3afc47
Instruction Fuzzy Hash: 1CB18D71A00209AFDF14DFA8CC55BEA3BB4FB08315F51822AFA15A72D0DB78E841CB55

Function 00760D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007610F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00761114
Part of subcall function 007610F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00760B9B,?,?,?), ref: 00761120
Part of subcall function 007610F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00760B9B,?,?,?), ref: 0076112F
Part of subcall function 007610F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00760B9B,?,?,?), ref: 00761136
Part of subcall function 007610F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0076114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00760DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00760E29
GetLengthSid.ADVAPI32(?), ref: 00760E40
GetAce.ADVAPI32(?,00000000,?), ref: 00760E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00760E96
GetLengthSid.ADVAPI32(?), ref: 00760EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00760EB5
HeapAlloc.KERNEL32(00000000), ref: 00760EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00760EDD
CopySid.ADVAPI32(00000000), ref: 00760EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00760F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00760F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00760F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00760F6E
HeapFree.KERNEL32(00000000), ref: 00760F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00760F7E
HeapFree.KERNEL32(00000000), ref: 00760F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00760F8E
HeapFree.KERNEL32(00000000), ref: 00760F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00760FA1
HeapFree.KERNEL32(00000000), ref: 00760FA8

Part of subcall function 00761193: GetProcessHeap.KERNEL32(00000008,00760BB1,?,00000000,?,00760BB1,?), ref: 007611A1
Part of subcall function 00761193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00760BB1,?), ref: 007611A8
Part of subcall function 00761193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00760BB1,?), ref: 007611B7

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: b678c2c8c457473178ad3fba9cf49cdb00805e8d67545fe8161086398eba9c28
Instruction ID: a8ed7d7ee560da03fd4de36791fac73efb8c462931dc84e36e290de7d85e7617
Opcode Fuzzy Hash: b678c2c8c457473178ad3fba9cf49cdb00805e8d67545fe8161086398eba9c28
Instruction Fuzzy Hash: 95715E7190021AEBDF219FA4DC49BEFBBB8BF05300F048115F91AA6251D7799A05CBA0

Function 0078C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0078C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0079CC08,00000000,?,00000000,?,?), ref: 0078C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0078C5A4
_wcslen.LIBCMT ref: 0078C5F4
_wcslen.LIBCMT ref: 0078C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0078C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0078C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0078C84D
RegCloseKey.ADVAPI32(?), ref: 0078C881
RegCloseKey.ADVAPI32(00000000), ref: 0078C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0078C960

Strings

REG_DWORD, xrefs: 0078C804
REG_SZ, xrefs: 0078C644
REG_QWORD, xrefs: 0078C8C3
REG_BINARY, xrefs: 0078C913
REG_MULTI_SZ, xrefs: 0078C6F5
REG_EXPAND_SZ, xrefs: 0078C5CD

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: bdf8f9ef32530193f35e55f2921be0b9a86e2c3e371c1b4155bb58766d2da16e
Instruction ID: a410a64c5e5ec4b4fcbeb9dd438b271d479c536bba6b2c636029723bf0f6a943
Opcode Fuzzy Hash: bdf8f9ef32530193f35e55f2921be0b9a86e2c3e371c1b4155bb58766d2da16e
Instruction Fuzzy Hash: 33127931604201DFDB15EF14C895A2AB7E5EF88714F14899CF88A9B3A2DB39FD41CB91

Function 0079091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007909C6
_wcslen.LIBCMT ref: 00790A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00790A54
_wcslen.LIBCMT ref: 00790A8A
_wcslen.LIBCMT ref: 00790B06
_wcslen.LIBCMT ref: 00790B81

Part of subcall function 0071F9F2: _wcslen.LIBCMT ref: 0071F9FD

Part of subcall function 00762BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00762BFA

Strings

COLLAPSE, xrefs: 00790B01, 00790B1C
GETTEXT, xrefs: 00790C97
GETTOTALCOUNT, xrefs: 007909F2, 00790A17
GETSELECTED, xrefs: 00790C4E
CHECK, xrefs: 00790A85, 00790AA0
UNCHECK, xrefs: 00790D3E
EXISTS, xrefs: 00790B7C, 00790B97
EXPAND, xrefs: 00790BF8
GETITEMCOUNT, xrefs: 00790C1E
ISCHECKED, xrefs: 00790CE1
SELECT, xrefs: 00790D11

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 317e258e3d4b9168c958f5f1951c55718a85a64192b4461a1cab00d7c72ba81a
Instruction ID: a7aeb6b57f085edb2333c4e7aa07370ec40556c8e38c13d86a17d903e1c66690
Opcode Fuzzy Hash: 317e258e3d4b9168c958f5f1951c55718a85a64192b4461a1cab00d7c72ba81a
Instruction Fuzzy Hash: DFE18A71218701DFCB14DF24D45496AB7E1FF98314B14895CF8969B3A2DB38ED85CB81

Function 0078C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0078B6AE,?,?), ref: 0078C9B5
_wcslen.LIBCMT ref: 0078C9F1
_wcslen.LIBCMT ref: 0078CA68
_wcslen.LIBCMT ref: 0078CA9E
_wcslen.LIBCMT ref: 0078CAF9
_wcslen.LIBCMT ref: 0078CB2F
_wcslen.LIBCMT ref: 0078CB7F

Strings

HKCR, xrefs: 0078CB29, 0078CB2E
HKEY_CURRENT_USER, xrefs: 0078CBBD
HKCC, xrefs: 0078CBAC
HKU, xrefs: 0078CBF0
HKEY_CURRENT_CONFIG, xrefs: 0078CB79, 0078CB7E
HKEY_USERS, xrefs: 0078CBDF
HKCU, xrefs: 0078CBCE
HKEY_LOCAL_MACHINE, xrefs: 0078CA62, 0078CA67
HKLM, xrefs: 0078CA98, 0078CA9D
HKEY_CLASSES_ROOT, xrefs: 0078CAF3, 0078CAF8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: d2b6a6e8476996ee04c285fb5e2e91c5a932ed4a659b5c6bc51b417df4e7e5e5
Instruction ID: 7b817385b0111f706bf6c26118faddc82834ab6e5a862cc609ca775f4b1dffbe
Opcode Fuzzy Hash: d2b6a6e8476996ee04c285fb5e2e91c5a932ed4a659b5c6bc51b417df4e7e5e5
Instruction Fuzzy Hash: CF71293264052A8BCB16FE7CCC41ABB3791AB60750F144129F865A7284EA3DDD44C7B1

Function 0079833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0079835A
_wcslen.LIBCMT ref: 0079836E
_wcslen.LIBCMT ref: 00798391
_wcslen.LIBCMT ref: 007983B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 007983F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00795BF2), ref: 0079844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00798487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 007984CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00798501
FreeLibrary.KERNEL32(?), ref: 0079850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0079851D
DestroyIcon.USER32(?,?,?,?,?,00795BF2), ref: 0079852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00798549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00798555

Strings

.icl, xrefs: 00798368
.dll, xrefs: 007983AB
.exe, xrefs: 00798388

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: ac762597c810b013c061b0c43bbd7a0cf8fed07d4fe19243d017c82e92a05f8e
Instruction ID: 377abc107c88cf23693651df3234777be255af48fe5491bd2569504681501686
Opcode Fuzzy Hash: ac762597c810b013c061b0c43bbd7a0cf8fed07d4fe19243d017c82e92a05f8e
Instruction Fuzzy Hash: 7761CF71540215FBEF14DF64EC45BBE77A8BF09721F10860AF815E61D1DB78AA90CBA0

Function 00707778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#OnAutoItStartRegister, xrefs: 00707817
#include, xrefs: 00707847
#ce, xrefs: 007078ED
Unterminated group of comments, xrefs: 0074528C
#include-once, xrefs: 0070782F
', xrefs: 00745169
#pragma compile, xrefs: 007077D3
Bad directive syntax error, xrefs: 0074519A
#requireadmin, xrefs: 007077FF
#comments-end, xrefs: 007078D9
Cannot parse #include, xrefs: 00745279
#cs, xrefs: 00707873, 007078C5
#comments-start, xrefs: 0070785F, 007078B1
", xrefs: 00745153
#notrayicon, xrefs: 007077E7

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: a9d86bdd7f8964c73c1b2a6f82403c12823e7bb8095bf0459cf229407d7608f1
Instruction ID: 9639fc9b08111e2fd704a1d1e68f8fb2d6024a6e5ce2196a7932c69dfd093a8b
Opcode Fuzzy Hash: a9d86bdd7f8964c73c1b2a6f82403c12823e7bb8095bf0459cf229407d7608f1
Instruction Fuzzy Hash: 288111B1A04205FBDF24AF60DC46FAE3BA8AF55340F044125F905AA1D2EB7DEA41C7A1

Function 00773E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00773EF8
_wcslen.LIBCMT ref: 00773F03
_wcslen.LIBCMT ref: 00773F5A
_wcslen.LIBCMT ref: 00773F98
GetDriveTypeW.KERNEL32(?), ref: 00773FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0077401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00774059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00774087

Strings

open, xrefs: 00773F54, 00773F59
set cd door , xrefs: 00774028
type cdaudio alias cd wait, xrefs: 00774001
closed, xrefs: 00773F08, 00773F2D, 00773F46, 00773F7E, 00773F97
close, xrefs: 00773EFE, 00773F18
close cd wait, xrefs: 00774072
wait, xrefs: 00774044
open , xrefs: 00773FE5

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 93e4f5d6b63adbecc9e4dccdd5d6ca827708c7101adf91704bab54f704ec0244
Instruction ID: 4b7d59500587e568ac2198280ba99f21d2d3334ef4c9f4e0546be49a5bc8b1f0
Opcode Fuzzy Hash: 93e4f5d6b63adbecc9e4dccdd5d6ca827708c7101adf91704bab54f704ec0244
Instruction Fuzzy Hash: 3171D272604211DFCB10EF24C88196AB7F4EF94794F108A2DF99997291EB38ED45CB91

Function 00765A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00765A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00765A40
SetWindowTextW.USER32(?,?), ref: 00765A57
GetDlgItem.USER32(?,000003EA), ref: 00765A6C
SetWindowTextW.USER32(00000000,?), ref: 00765A72
GetDlgItem.USER32(?,000003E9), ref: 00765A82
SetWindowTextW.USER32(00000000,?), ref: 00765A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00765AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00765AC3
GetWindowRect.USER32(?,?), ref: 00765ACC
_wcslen.LIBCMT ref: 00765B33
SetWindowTextW.USER32(?,?), ref: 00765B6F
GetDesktopWindow.USER32 ref: 00765B75
GetWindowRect.USER32(00000000), ref: 00765B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00765BD3
GetClientRect.USER32(?,?), ref: 00765BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00765C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00765C2F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: edb801e60024899aec1a5db56d25cf7943e4f89c5a689f0d392b5b4e63424c74
Instruction ID: ec96d7c2ced9675beb9b0a9c41ade889ea83d658d497777402e26ecce7137790
Opcode Fuzzy Hash: edb801e60024899aec1a5db56d25cf7943e4f89c5a689f0d392b5b4e63424c74
Instruction Fuzzy Hash: A5718C71900B09EFDB21DFA8CE85AAEBBF5FF48704F104619E587A25A0D778E940DB14

Function 0077FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0077FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0077FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0077FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0077FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0077FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0077FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0077FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0077FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0077FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0077FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0077FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0077FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0077FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0077FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0077FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0077FECC
GetCursorInfo.USER32(?), ref: 0077FEDC
GetLastError.KERNEL32 ref: 0077FF1E

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: f496b5e971f9875d50225ec4931db12cba711511bd56507241e81ecd4b2f20ef
Instruction ID: 77243537122cfacbf6077310673da2f8fadae3e3fc8e6984b7ddc82d10bc4289
Opcode Fuzzy Hash: f496b5e971f9875d50225ec4931db12cba711511bd56507241e81ecd4b2f20ef
Instruction Fuzzy Hash: BE4125B0D04319AADB109FBA8C89C5EBFE8FF04754B54852AE11DE7281DB78A901CE91

Function 007630F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0076318D
_wcslen.LIBCMT ref: 007631F8

Strings

CLASS, xrefs: 00763188, 007631A5
CLASSNN, xrefs: 007631F3, 00763204
REGEXPCLASS, xrefs: 00763255, 00763266
TEXT, xrefs: 0076347C
[|, xrefs: 0076339A
NAME, xrefs: 00763335, 00763346
INSTANCE, xrefs: 00763453

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[|
API String ID: 176396367-3113052777
Opcode ID: 87e760b1308066d65d37ad17bfc22f264a8ee3b80a61f4db2b209d0d86e63912
Instruction ID: 6f308500ed5af7f417c5b6651c1a763610fddef929650520cbcc5cb668a59e29
Opcode Fuzzy Hash: 87e760b1308066d65d37ad17bfc22f264a8ee3b80a61f4db2b209d0d86e63912
Instruction Fuzzy Hash: 58E1A432A00526EBCB189F78C455BEDFBB4BF54710F54822DE857A7281DB38AE85C790

Function 007200C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 007200C6

Part of subcall function 007200ED: InitializeCriticalSectionAndSpinCount.KERNEL32(007D070C,00000FA0,C7892A16,?,?,?,?,007423B3,000000FF), ref: 0072011C
Part of subcall function 007200ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,007423B3,000000FF), ref: 00720127
Part of subcall function 007200ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,007423B3,000000FF), ref: 00720138
Part of subcall function 007200ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0072014E
Part of subcall function 007200ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0072015C
Part of subcall function 007200ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0072016A
Part of subcall function 007200ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00720195
Part of subcall function 007200ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 007201A0

___scrt_fastfail.LIBCMT ref: 007200E7

Part of subcall function 007200A3: __onexit.LIBCMT ref: 007200A9

Strings

SleepConditionVariableCS, xrefs: 00720154
InitializeConditionVariable, xrefs: 00720148
kernel32.dll, xrefs: 00720133
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00720122
WakeAllConditionVariable, xrefs: 00720162

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: ce1dcba0835ed685790824bc3a8466a711f15996167a65925311f29a47b71cb5
Instruction ID: 3886bbd3b403c4c8c0cef0958bf1f4e31fb5346db007a98fa76b5f10f84d0388
Opcode Fuzzy Hash: ce1dcba0835ed685790824bc3a8466a711f15996167a65925311f29a47b71cb5
Instruction Fuzzy Hash: 4621F9B2645724ABEF115B74BC0AB6E33A4DB05B61F00412BF801E62D2DB7C98108AE8

Function 007744C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0079CC08), ref: 00774527
_wcslen.LIBCMT ref: 0077453B
_wcslen.LIBCMT ref: 00774599
_wcslen.LIBCMT ref: 007745F4
_wcslen.LIBCMT ref: 0077463F
_wcslen.LIBCMT ref: 007746A7

Part of subcall function 0071F9F2: _wcslen.LIBCMT ref: 0071F9FD

GetDriveTypeW.KERNEL32(?,007C6BF0,00000061), ref: 00774743

Strings

unknown, xrefs: 00774708
cdrom, xrefs: 0077458F, 00774594
ramdisk, xrefs: 007746F1
removable, xrefs: 007745EA, 007745EF
network, xrefs: 0077469D, 007746A2
fixed, xrefs: 00774635, 0077463A
all, xrefs: 00774531, 00774536

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 5ecd731d13e0f3426f538799edea8fec7f48d41f922276ffd51db36674426fae
Instruction ID: d54de49e7fd6d2a6e3326a99ea7738f587d7b4892a7ed8f05afb05ceb46a1be6
Opcode Fuzzy Hash: 5ecd731d13e0f3426f538799edea8fec7f48d41f922276ffd51db36674426fae
Instruction Fuzzy Hash: 10B1F571608302DFCB14DF28C894A6AB7E5BF957A0F508A1DF49AC7291D738DD44CB92

Function 0079911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00719BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00719BB2

DragQueryPoint.SHELL32(?,?), ref: 00799147

Part of subcall function 00797674: ClientToScreen.USER32(?,?), ref: 0079769A
Part of subcall function 00797674: GetWindowRect.USER32(?,?), ref: 00797710
Part of subcall function 00797674: PtInRect.USER32(?,?,00798B89), ref: 00797720

SendMessageW.USER32(?,000000B0,?,?), ref: 007991B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 007991BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 007991DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00799225
SendMessageW.USER32(?,000000B0,?,?), ref: 0079923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00799255
SendMessageW.USER32(?,000000B1,?,?), ref: 00799277
DragFinish.SHELL32(?), ref: 0079927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00799371

Strings

@GUI_DRAGFILE, xrefs: 00799320
@GUI_DROPID, xrefs: 0079929E
p#}, xrefs: 007992BB
@GUI_DRAGID, xrefs: 007992E9

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#}
API String ID: 221274066-1593647580
Opcode ID: 8c72b4027d75e292475058ac47ce84e2c0b81d3d60401f293165c658130949bc
Instruction ID: 5423412cc82a2c5c772bbee2e3c424b456c80feaedfddfd82468a576110ec5e4
Opcode Fuzzy Hash: 8c72b4027d75e292475058ac47ce84e2c0b81d3d60401f293165c658130949bc
Instruction Fuzzy Hash: 85615D71108301EFD701DF64DC89DAFBBE8EF85750F404A1EF695921A1DB349A45CB62

Function 0070326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(007D1990), ref: 00742F8D
GetMenuItemCount.USER32(007D1990), ref: 0074303D
GetCursorPos.USER32(?), ref: 00743081
SetForegroundWindow.USER32(00000000), ref: 0074308A
TrackPopupMenuEx.USER32(007D1990,00000000,?,00000000,00000000,00000000), ref: 0074309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 007430A9

Strings

0, xrefs: 0070327D

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: d4d415eb7e881549eb0b5a9346c277b3f249248a7d94180183b649239a77cad0
Instruction ID: 1e8243fcb240387636556c92daba3e0b8b03affd4b1dbaf9f87defab7c7f8970
Opcode Fuzzy Hash: d4d415eb7e881549eb0b5a9346c277b3f249248a7d94180183b649239a77cad0
Instruction Fuzzy Hash: F7712931640215FFEB218F24CC49FAABFA9FF05324F204206F529A61E1C7B9A965C750

Function 00796CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00796DEB

Part of subcall function 00706B57: _wcslen.LIBCMT ref: 00706B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00796E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00796E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00796E94
DestroyWindow.USER32(?), ref: 00796EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00700000,00000000), ref: 00796EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00796EFD
GetDesktopWindow.USER32 ref: 00796F16
GetWindowRect.USER32(00000000), ref: 00796F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00796F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00796F4D

Part of subcall function 00719944: GetWindowLongW.USER32(?,000000EB), ref: 00719952

Strings

tooltips_class32, xrefs: 00796E58, 00796EDD
0, xrefs: 00796D98

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: b45aa606acac7e3a252b9320791398d04348a04808b1fde4f534798ce7c57160
Instruction ID: 1572c0ef118eb5a285e53ef361a54d8370cce0199a4ec013bb63fcfcbf5c1183
Opcode Fuzzy Hash: b45aa606acac7e3a252b9320791398d04348a04808b1fde4f534798ce7c57160
Instruction Fuzzy Hash: CE7167B0104240AFDB21CF18E858FBABBF9FB89304F44465EF98997261C778E906CB15

Function 0077C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0077C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0077C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0077C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0077C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0077C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0077C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0077C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0077C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0077C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0077C5F0
InternetCloseHandle.WININET(00000000), ref: 0077C5FB

Strings

, xrefs: 0077C575

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 19425f8b0a1f7e432b25c5353f64a1ba555c62f88a8478d5aa838ca957ba3ed0
Instruction ID: d1b05852f069b79d8451eff984867a62f3351fae221299eba7f4709a6c118e18
Opcode Fuzzy Hash: 19425f8b0a1f7e432b25c5353f64a1ba555c62f88a8478d5aa838ca957ba3ed0
Instruction Fuzzy Hash: 8C514DB1500604BFDF228FA0C988AAB7BBCFF08794F10841EF94996210DB39E9559B60

Function 0079856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00798592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007985A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007985AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007985BA
GlobalLock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007985C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007985D7
GlobalUnlock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007985E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007985E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007985F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0079FC38,?), ref: 00798611
GlobalFree.KERNEL32(00000000), ref: 00798621
GetObjectW.GDI32(?,00000018,?), ref: 00798641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00798671
DeleteObject.GDI32(?), ref: 00798699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 007986AF

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: db6dfeabde939d8df8a536772c323d0b3b387bcffb66ffdcee87cf4e19724e5e
Instruction ID: a6cea2f631b3ce83ee15345142d163e559fcc4a50b0823364b32050d84cfc77e
Opcode Fuzzy Hash: db6dfeabde939d8df8a536772c323d0b3b387bcffb66ffdcee87cf4e19724e5e
Instruction Fuzzy Hash: A2410C75600208AFDF11DFA5DD48EAA7BB8FF89711F108059F905EB260DB789D02CB65

Function 007714BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00771502
VariantCopy.OLEAUT32(?,?), ref: 0077150B
VariantClear.OLEAUT32(?), ref: 00771517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 007715FB
VarR8FromDec.OLEAUT32(?,?), ref: 00771657
VariantInit.OLEAUT32(?), ref: 00771708
SysFreeString.OLEAUT32(?), ref: 0077178C
VariantClear.OLEAUT32(?), ref: 007717D8
VariantClear.OLEAUT32(?), ref: 007717E7
VariantInit.OLEAUT32(00000000), ref: 00771823

Strings

Default, xrefs: 007716AF
%4d%02d%02d%02d%02d%02d, xrefs: 00771625

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 83ae711920ea0afd77b975111c4a3cc093038102a59cdc824c1117cfb1f6156e
Instruction ID: 7dbaf52b4649bfecd505218bb8d9f5b68141c217175d5a4afe10b4df68e03e1f
Opcode Fuzzy Hash: 83ae711920ea0afd77b975111c4a3cc093038102a59cdc824c1117cfb1f6156e
Instruction Fuzzy Hash: 68D11471A00105EBDF089F68D889BBDB7B5BF44740F94C156E44AAB180DB3CEC51DBA1

Function 0078B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

Part of subcall function 0078C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0078B6AE,?,?), ref: 0078C9B5
Part of subcall function 0078C998: _wcslen.LIBCMT ref: 0078C9F1
Part of subcall function 0078C998: _wcslen.LIBCMT ref: 0078CA68
Part of subcall function 0078C998: _wcslen.LIBCMT ref: 0078CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0078B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0078B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0078B80A
RegCloseKey.ADVAPI32(?), ref: 0078B87E
RegCloseKey.ADVAPI32(?), ref: 0078B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0078B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0078B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0078B922
FreeLibrary.KERNEL32(00000000), ref: 0078B983
RegCloseKey.ADVAPI32(00000000), ref: 0078B994

Strings

RegDeleteKeyExW, xrefs: 0078B8FE
advapi32.dll, xrefs: 0078B8ED

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 9fee26faecc1e18bd0e7302e9ab2a5cffbd751975a048df93b43b084da761fee
Instruction ID: 0148b5582770374f6c4bb02ea3601283a4afbd54c0601012714159169ca38a8a
Opcode Fuzzy Hash: 9fee26faecc1e18bd0e7302e9ab2a5cffbd751975a048df93b43b084da761fee
Instruction Fuzzy Hash: 4CC18E71204201EFD715EF14C499F2ABBE5BF84318F14859DF59A8B2A2CB39EC45CB91

Function 0078255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 007825D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 007825E8
CreateCompatibleDC.GDI32(?), ref: 007825F4
SelectObject.GDI32(00000000,?), ref: 00782601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0078266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 007826AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 007826D0
SelectObject.GDI32(?,?), ref: 007826D8
DeleteObject.GDI32(?), ref: 007826E1
DeleteDC.GDI32(?), ref: 007826E8
ReleaseDC.USER32(00000000,?), ref: 007826F3

Strings

(, xrefs: 0078268D

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: db9fe69cfc806a75ed4ed702c58172ceea02864c444dcdcd115aedc293871d02
Instruction ID: d5461daa8f1232261d388313615f24ab28ca4edc37d956c031a5d1f234ebee7a
Opcode Fuzzy Hash: db9fe69cfc806a75ed4ed702c58172ceea02864c444dcdcd115aedc293871d02
Instruction Fuzzy Hash: 526115B5D00209EFCF05DFA8D884AAEBBB5FF48310F20841AE555A7250E734A941CF64

Function 0073DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0073DAA1

Part of subcall function 0073D63C: _free.LIBCMT ref: 0073D659
Part of subcall function 0073D63C: _free.LIBCMT ref: 0073D66B
Part of subcall function 0073D63C: _free.LIBCMT ref: 0073D67D
Part of subcall function 0073D63C: _free.LIBCMT ref: 0073D68F
Part of subcall function 0073D63C: _free.LIBCMT ref: 0073D6A1
Part of subcall function 0073D63C: _free.LIBCMT ref: 0073D6B3
Part of subcall function 0073D63C: _free.LIBCMT ref: 0073D6C5
Part of subcall function 0073D63C: _free.LIBCMT ref: 0073D6D7
Part of subcall function 0073D63C: _free.LIBCMT ref: 0073D6E9
Part of subcall function 0073D63C: _free.LIBCMT ref: 0073D6FB
Part of subcall function 0073D63C: _free.LIBCMT ref: 0073D70D
Part of subcall function 0073D63C: _free.LIBCMT ref: 0073D71F
Part of subcall function 0073D63C: _free.LIBCMT ref: 0073D731

_free.LIBCMT ref: 0073DA96

Part of subcall function 007329C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0073D7D1,00000000,00000000,00000000,00000000,?,0073D7F8,00000000,00000007,00000000,?,0073DBF5,00000000), ref: 007329DE
Part of subcall function 007329C8: GetLastError.KERNEL32(00000000,?,0073D7D1,00000000,00000000,00000000,00000000,?,0073D7F8,00000000,00000007,00000000,?,0073DBF5,00000000,00000000), ref: 007329F0

_free.LIBCMT ref: 0073DAB8
_free.LIBCMT ref: 0073DACD
_free.LIBCMT ref: 0073DAD8
_free.LIBCMT ref: 0073DAFA
_free.LIBCMT ref: 0073DB0D
_free.LIBCMT ref: 0073DB1B
_free.LIBCMT ref: 0073DB26
_free.LIBCMT ref: 0073DB5E
_free.LIBCMT ref: 0073DB65
_free.LIBCMT ref: 0073DB82
_free.LIBCMT ref: 0073DB9A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: ba22e2253fd9043e17e20f629915dec01e6f329c80ec3ff74eae4f6cf254c7d2
Instruction ID: 581bc6993fab5e6032b419e8dd6a50ca15eaebf048ff3206e75da2e0766ac547
Opcode Fuzzy Hash: ba22e2253fd9043e17e20f629915dec01e6f329c80ec3ff74eae4f6cf254c7d2
Instruction Fuzzy Hash: 2B314C72604205DFFB32AA79F849B56B7E9FF00310F154469E499E71A3DB39BC418B20

Function 0076365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0076369C
_wcslen.LIBCMT ref: 007636A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00763797
GetClassNameW.USER32(?,?,00000400), ref: 0076380C
GetDlgCtrlID.USER32(?), ref: 0076385D
GetWindowRect.USER32(?,?), ref: 00763882
GetParent.USER32(?), ref: 007638A0
ScreenToClient.USER32(00000000), ref: 007638A7
GetClassNameW.USER32(?,?,00000100), ref: 00763921
GetWindowTextW.USER32(?,?,00000400), ref: 0076395D

Strings

%s%u, xrefs: 00763734

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 5eaab1790170c02f8077d176cce1f3e3876a9e65615a508fdebacb44d40888ff
Instruction ID: 88a184ffba92ce7d8498f8a033e4ef677703a80fa32b6a6d574f5d1ca037d8eb
Opcode Fuzzy Hash: 5eaab1790170c02f8077d176cce1f3e3876a9e65615a508fdebacb44d40888ff
Instruction Fuzzy Hash: FF919371204706EFD719DF24C885BEAB7A8FF44354F008619FD9AD2190DB38EA55CBA1

Function 00764954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00764994
GetWindowTextW.USER32(?,?,00000400), ref: 007649DA
_wcslen.LIBCMT ref: 007649EB
CharUpperBuffW.USER32(?,00000000), ref: 007649F7
_wcsstr.LIBVCRUNTIME ref: 00764A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00764A64
GetWindowTextW.USER32(?,?,00000400), ref: 00764A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00764AE6
GetClassNameW.USER32(?,?,00000400), ref: 00764B20
GetWindowRect.USER32(?,?), ref: 00764B8B

Strings

ThumbnailClass, xrefs: 00764A6F, 00764AF1

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 7ad4d749dc0c4046a8bca27b1017e0a28f047682d8e6eb4ab952541f2177672b
Instruction ID: 86d03eebc15da39a27ca0d35f02c1b3e2959f3b8b00e676283d390ba39f4837d
Opcode Fuzzy Hash: 7ad4d749dc0c4046a8bca27b1017e0a28f047682d8e6eb4ab952541f2177672b
Instruction Fuzzy Hash: 6391BC71004205EFDB05DF14C989FAA77E8FF84314F04846AFD8A9A196DB38ED46CBA1

Function 00798D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00719BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00719BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00798D5A
GetFocus.USER32 ref: 00798D6A
GetDlgCtrlID.USER32(00000000), ref: 00798D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00798E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00798ECF
GetMenuItemCount.USER32(?), ref: 00798EEC
GetMenuItemID.USER32(?,00000000), ref: 00798EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00798F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00798F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00798FA1

Strings

0, xrefs: 00798E9F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 283aa6a14628198eabc79a630bd519a34a64cee7eae6f4b20464b564436c38f2
Instruction ID: 456dc8fa632b2a797d6d7bf599bca3e5dae6328016d4f95f78b4bf7037b6b62b
Opcode Fuzzy Hash: 283aa6a14628198eabc79a630bd519a34a64cee7eae6f4b20464b564436c38f2
Instruction Fuzzy Hash: 6681E271508301AFDF51CF24E888EAB7BEAFB8A314F14051EF99597291DB38D901CB62

Function 0078CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0078CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0078CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0078CD48

Part of subcall function 0078CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0078CCAA
Part of subcall function 0078CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0078CCBD
Part of subcall function 0078CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0078CCCF
Part of subcall function 0078CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0078CD05
Part of subcall function 0078CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0078CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0078CCF3

Strings

RegDeleteKeyExW, xrefs: 0078CCC9
advapi32.dll, xrefs: 0078CCB8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 7a634c5ab9a05a98cc622751e8e5a5b459dd47d986792532cb47ed055b803af5
Instruction ID: 111760810ec4e6fa4a6a6e7e516eef06427ae2230743fde3b58bfa0734241d79
Opcode Fuzzy Hash: 7a634c5ab9a05a98cc622751e8e5a5b459dd47d986792532cb47ed055b803af5
Instruction Fuzzy Hash: 663180B1A41128BBDB22AB55DC88EFFBB7CEF05740F004166A905E7140DA389A46DBB4

Function 00773D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00773D40
_wcslen.LIBCMT ref: 00773D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00773D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00773DBE
RemoveDirectoryW.KERNEL32(?), ref: 00773DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00773E55
CloseHandle.KERNEL32(00000000), ref: 00773E60
CloseHandle.KERNEL32(00000000), ref: 00773E6B

Strings

:, xrefs: 00773D82
\, xrefs: 00773D77
\??\%s, xrefs: 00773D5B

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 91676271921f4d2a8e0c26b743ad18f8e3449d4f2279b0c65304a6ccdb602f96
Instruction ID: 4c7f3d5cafff865d76edfa73c08c98cba0ad3c85e6dc9082fd5f1d552f146ee3
Opcode Fuzzy Hash: 91676271921f4d2a8e0c26b743ad18f8e3449d4f2279b0c65304a6ccdb602f96
Instruction Fuzzy Hash: 1C3181B1A00219ABDF219BA0DC49FEB37BCEF88740F1081B6F509D6161E77897459B64

Function 0076E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0076E6B4

Part of subcall function 0071E551: timeGetTime.WINMM(?,?,0076E6D4), ref: 0071E555

Sleep.KERNEL32(0000000A), ref: 0076E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0076E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0076E727
SetActiveWindow.USER32 ref: 0076E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0076E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0076E773
Sleep.KERNEL32(000000FA), ref: 0076E77E
IsWindow.USER32 ref: 0076E78A
EndDialog.USER32(00000000), ref: 0076E79B

Strings

BUTTON, xrefs: 0076E719

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 19437b723f9e7415a491e68c19b8597da75905dfbded1df828c175617b7f345b
Instruction ID: 86521310e75472d10a3aacb3a94c598b13e2291801384432592317a5c0d57fbe
Opcode Fuzzy Hash: 19437b723f9e7415a491e68c19b8597da75905dfbded1df828c175617b7f345b
Instruction Fuzzy Hash: 022181B5241304AFEF025F64EC89A253B79FB64748B10C426F902825A2DB7DAC16DB3C

Function 0076E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0076EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0076EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0076EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0076EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0076EAA7

Strings

status PlayMe mode, xrefs: 0076EA58
close PlayMe, xrefs: 0076EA6E, 0076EA9B
play PlayMe wait, xrefs: 0076EA91
play PlayMe, xrefs: 0076EAA2
open , xrefs: 0076EA0C
alias PlayMe, xrefs: 0076EA36

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 32bf0528ca0399e1d5f956f3973705c83eaf41e506e144a62041ca8bfbc1a601
Instruction ID: 1b06f77cd8ed26d46f3f078b746994d8739d41fab34daca6f82c9fbfe2a82369
Opcode Fuzzy Hash: 32bf0528ca0399e1d5f956f3973705c83eaf41e506e144a62041ca8bfbc1a601
Instruction Fuzzy Hash: 3711C6B5A50219B9D720A7A5DD8AEFF6BBCEFD1F00F00452D7801A20D1EE785D05C6B0

Function 00765CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00765CE2
GetWindowRect.USER32(00000000,?), ref: 00765CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00765D59
GetDlgItem.USER32(?,00000002), ref: 00765D69
GetWindowRect.USER32(00000000,?), ref: 00765D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00765DCF
GetDlgItem.USER32(?,000003E9), ref: 00765DDD
GetWindowRect.USER32(00000000,?), ref: 00765DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00765E31
GetDlgItem.USER32(?,000003EA), ref: 00765E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00765E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00765E67

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 4babd95a4254937885d0274ba4a16721c15a5c8cb2758d631b0cef12ea9c3588
Instruction ID: a622660c45ede114d2f34288fe987b44184b74b92518ee6c3db82a36740186a3
Opcode Fuzzy Hash: 4babd95a4254937885d0274ba4a16721c15a5c8cb2758d631b0cef12ea9c3588
Instruction Fuzzy Hash: F8511171B00605AFDF19CF68DD89AAE7BB5FB48300F548229F916E7290D7749E01CB60

Function 00718BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00718F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00718BE8,?,00000000,?,?,?,?,00718BBA,00000000,?), ref: 00718FC5

DestroyWindow.USER32(?), ref: 00718C81
KillTimer.USER32(00000000,?,?,?,?,00718BBA,00000000,?), ref: 00718D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00756973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00718BBA,00000000,?), ref: 007569A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00718BBA,00000000,?), ref: 007569B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00718BBA,00000000), ref: 007569D4
DeleteObject.GDI32(00000000), ref: 007569E6

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: fa1c54e7f7c7c4b438f07043b6adebd4f5a2d5bb6cab5ee3239166efe93bf043
Instruction ID: 926795d4334a65c4c65f857a64f03dc7c57b55b70759ba9c91666d7b05c07324
Opcode Fuzzy Hash: fa1c54e7f7c7c4b438f07043b6adebd4f5a2d5bb6cab5ee3239166efe93bf043
Instruction Fuzzy Hash: F661AC30502600EFCB629F18D958BA577F2FB40312F94855EE4429B5A0CB7DB9C5CFAA

Function 00719838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00719944: GetWindowLongW.USER32(?,000000EB), ref: 00719952

GetSysColor.USER32(0000000F), ref: 00719862

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 62a85e8faff2c4f906e914aa6e2971783f75e286a672e360a4f6bd711bf613a0
Instruction ID: 24f4d7fbb394ccaee313e8a51af656b71843643a6e8db4cefef2649b63a624ea
Opcode Fuzzy Hash: 62a85e8faff2c4f906e914aa6e2971783f75e286a672e360a4f6bd711bf613a0
Instruction Fuzzy Hash: 0D419E31104644AFDF219B3C9C98BF93BA5AB46321F148606FAA28B1E1D6789C83DB14

Function 00738D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.r, xrefs: 0073903A, 00738FD0, 00738FF2

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID: .r
API String ID: 0-397233886
Opcode ID: 2ca0a767030ac3231e6f8209e74b2fbdc42a82379da40d9e5422bbaed7f4787e
Instruction ID: 692916969912b000616d9d3dd1027c5642aba0b4fdf7ee25fd58b7e65c4dc2c7
Opcode Fuzzy Hash: 2ca0a767030ac3231e6f8209e74b2fbdc42a82379da40d9e5422bbaed7f4787e
Instruction Fuzzy Hash: 6CC1F075A0434AEFEB159FA8D844BADBBB0BF09310F144099F554AB393C77C9941CB62

Function 007696E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0074F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00769717
LoadStringW.USER32(00000000,?,0074F7F8,00000001), ref: 00769720

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0074F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00769742
LoadStringW.USER32(00000000,?,0074F7F8,00000001), ref: 00769745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00769866

Strings

Error: , xrefs: 0076981D
^ ERROR, xrefs: 007697FB
Line %d:, xrefs: 007697A0
Line %d (File "%s"):, xrefs: 0076978F
%s (%d) : ==> %s: %s %s, xrefs: 0076984A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 3e00327f07c80c5ccbaebca368b18985bd0f12d7fee9d70bbb906dd3e221266f
Instruction ID: 26db274c84819ea8eb4ccda4237c5c9c7596fd87550abecee272c4af6ba117c7
Opcode Fuzzy Hash: 3e00327f07c80c5ccbaebca368b18985bd0f12d7fee9d70bbb906dd3e221266f
Instruction Fuzzy Hash: D8412072800209EADF05EBE0DD8ADEEB7BCAF55340F504165F606720D2EA396F49CB61

Function 007606DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00706B57: _wcslen.LIBCMT ref: 00706B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 007607A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 007607BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 007607DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00760804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0076082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00760837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0076083C

Strings

\CLSID, xrefs: 00760724
SOFTWARE\Classes\, xrefs: 0076070E
\IPC$, xrefs: 00760784

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: ed1a45b6b3e988da6ed056bc5b381f28615700eb3d8c536e5c8b7d052a299914
Instruction ID: 23cc874d35b3c49e411c822c83072b33a7bd24aa61e1ec7bd50991b0f9a792e4
Opcode Fuzzy Hash: ed1a45b6b3e988da6ed056bc5b381f28615700eb3d8c536e5c8b7d052a299914
Instruction Fuzzy Hash: 19410B71C10229EBDF15EB94DC99DEEB7B8FF04350F144269E905A31A1EB386E44CB90

Function 00783C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00783C5C
CoInitialize.OLE32(00000000), ref: 00783C8A
CoUninitialize.OLE32 ref: 00783C94
_wcslen.LIBCMT ref: 00783D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00783DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00783ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00783F0E
CoGetObject.OLE32(?,00000000,0079FB98,?), ref: 00783F2D
SetErrorMode.KERNEL32(00000000), ref: 00783F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00783FC4
VariantClear.OLEAUT32(?), ref: 00783FD8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 4089a738dba264a7b29e23a4d86ee9617e83799a9085c9141c79672babe73d5a
Instruction ID: 7d4fda29b5a8c922baa35e0005afab68f118c7d9333ecde121f3a3ecb6a2ee4c
Opcode Fuzzy Hash: 4089a738dba264a7b29e23a4d86ee9617e83799a9085c9141c79672babe73d5a
Instruction Fuzzy Hash: 23C13771608205DFD700EF68C88492BB7E9FF89B44F04491DF98A9B251D735ED45CBA2

Function 00777A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00777AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00777B8F
SHGetDesktopFolder.SHELL32(?), ref: 00777BA3
CoCreateInstance.OLE32(0079FD08,00000000,00000001,007C6E6C,?), ref: 00777BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00777C74
CoTaskMemFree.OLE32(?,?), ref: 00777CCC
SHBrowseForFolderW.SHELL32(?), ref: 00777D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00777D7A
CoTaskMemFree.OLE32(00000000), ref: 00777D81
CoTaskMemFree.OLE32(00000000), ref: 00777DD6
CoUninitialize.OLE32 ref: 00777DDC

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 02c819c524854c39e15dd8a626dd75852d051fa821ff2f62e173c13a51ec9384
Instruction ID: c51e37ae4893015bcfce43af7bdb4f0a4c68132548d98a9c574775d09573e6dd
Opcode Fuzzy Hash: 02c819c524854c39e15dd8a626dd75852d051fa821ff2f62e173c13a51ec9384
Instruction Fuzzy Hash: 14C12A75A04209EFCB14DFA4C888DAEBBF9FF48344B148599E9199B361D734EE41CB90

Function 0079541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00795504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00795515
CharNextW.USER32(00000158), ref: 00795544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00795585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0079559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007955AC

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 68ea269d902d24f615f543aee97d011c6e18d5bec857ff8bb2e6e45e73e2c8c6
Instruction ID: d4144efd9e7754c10866397a45ce64137bdc712764165a7a55448511115bbeaf
Opcode Fuzzy Hash: 68ea269d902d24f615f543aee97d011c6e18d5bec857ff8bb2e6e45e73e2c8c6
Instruction Fuzzy Hash: 44619F71900628EFDF12DF94EC84DFE7BB9EB05720F108145F925AB2A1D7789A81DB60

Function 0075FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0075FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0075FB08
VariantInit.OLEAUT32(?), ref: 0075FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0075FB3A
VariantCopy.OLEAUT32(?,?), ref: 0075FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0075FBA1
VariantClear.OLEAUT32(?), ref: 0075FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0075FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0075FBCC
VariantClear.OLEAUT32(?), ref: 0075FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0075FBE9

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 95dc87925049094b18675cbea33ec587eff0c8d4c60b2093b031b6ea3a7c8405
Instruction ID: 7b22d9331cd46bdef6464ca02f061898f1227d8cee1339765ff1f5849b513e95
Opcode Fuzzy Hash: 95dc87925049094b18675cbea33ec587eff0c8d4c60b2093b031b6ea3a7c8405
Instruction Fuzzy Hash: 43415F75A00219DFCF01DF68C8589EEBBB9EF08355F00C069E905A7261CB78A946CFA1

Function 00769C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00769CA1
GetAsyncKeyState.USER32(000000A0), ref: 00769D22
GetKeyState.USER32(000000A0), ref: 00769D3D
GetAsyncKeyState.USER32(000000A1), ref: 00769D57
GetKeyState.USER32(000000A1), ref: 00769D6C
GetAsyncKeyState.USER32(00000011), ref: 00769D84
GetKeyState.USER32(00000011), ref: 00769D96
GetAsyncKeyState.USER32(00000012), ref: 00769DAE
GetKeyState.USER32(00000012), ref: 00769DC0
GetAsyncKeyState.USER32(0000005B), ref: 00769DD8
GetKeyState.USER32(0000005B), ref: 00769DEA

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 2474b1afed8430ab411974f4441de308d9e8c9537f3633646d3a5a1165687641
Instruction ID: f5d31bc046defc056a1d08f4199f3254063977160d47fb6757a94daa01873af4
Opcode Fuzzy Hash: 2474b1afed8430ab411974f4441de308d9e8c9537f3633646d3a5a1165687641
Instruction Fuzzy Hash: 204195346047C969FF71977488043B5BEA86F11344F08806ADFC7566C2EBBD99D8CBA2

Function 0078055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 007805BC
inet_addr.WSOCK32(?), ref: 0078061C
gethostbyname.WSOCK32(?), ref: 00780628
IcmpCreateFile.IPHLPAPI ref: 00780636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 007806C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 007806E5
IcmpCloseHandle.IPHLPAPI(?), ref: 007807B9
WSACleanup.WSOCK32 ref: 007807BF

Strings

Ping, xrefs: 00780676

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 1011012bf443394c9ae433f04ecaad750268b6f306d9a7c0fa595ae739d04bdd
Instruction ID: c7a0120e5cebd1424a696a18a00c80bfd8b2ee7e3287fa9833a82ae6be5769b3
Opcode Fuzzy Hash: 1011012bf443394c9ae433f04ecaad750268b6f306d9a7c0fa595ae739d04bdd
Instruction Fuzzy Hash: 5091AE75648201DFDB60EF15C889F1ABBE0AF44318F1485A9F4698B6A2C738ED49CFD1

Function 00788CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00788CF3

Part of subcall function 00768E54: _wcslen.LIBCMT ref: 00768E77

_wcslen.LIBCMT ref: 00788D4E
_wcslen.LIBCMT ref: 00788D9C
_wcslen.LIBCMT ref: 00788DDC
_wcslen.LIBCMT ref: 00788E6E

Strings

stdcall, xrefs: 00788DD6, 00788DDB
winapi, xrefs: 00788D96, 00788D9B
none, xrefs: 00788E65, 00788E6A
cdecl, xrefs: 00788D48, 00788D4D

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 6e7f4e3f98b52cc2fec2fb17fabca3b23e0559a9d9a376771a261ab2a4af6484
Instruction ID: 1dfddc807f1dc8bcfcdcad7b18fb241a28fc89db6771fe7d7b6bea0a02011201
Opcode Fuzzy Hash: 6e7f4e3f98b52cc2fec2fb17fabca3b23e0559a9d9a376771a261ab2a4af6484
Instruction Fuzzy Hash: D551A131A40116DBCF54EF6CC9409BEB7A5BF64320BA04229E966E72C5DF39ED40C791

Function 0078372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00783774
CoUninitialize.OLE32 ref: 0078377F
CoCreateInstance.OLE32(?,00000000,00000017,0079FB78,?), ref: 007837D9
IIDFromString.OLE32(?,?), ref: 0078384C
VariantInit.OLEAUT32(?), ref: 007838E4
VariantClear.OLEAUT32(?), ref: 00783936

Strings

Invalid parameter, xrefs: 00783865
Failed to create object, xrefs: 007837E4, 0078389A
NULL Pointer assignment, xrefs: 0078381E

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: aed654734a39127f3842ac2a5fb45bed2b733cc9e7471618a51ce21938f067a7
Instruction ID: 7770f843ac728c275ff6a0ce26a828f0fab50d5040a1416f170152c740f895f9
Opcode Fuzzy Hash: aed654734a39127f3842ac2a5fb45bed2b733cc9e7471618a51ce21938f067a7
Instruction Fuzzy Hash: 2561AFB0648301EFD711EF58C889F5AB7E4AF48B14F00490DF9859B291C778EE49CBA2

Function 00798B02 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00719BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00719BB2

Part of subcall function 0071912D: GetCursorPos.USER32(?), ref: 00719141
Part of subcall function 0071912D: ScreenToClient.USER32(00000000,?), ref: 0071915E
Part of subcall function 0071912D: GetAsyncKeyState.USER32(00000001), ref: 00719183
Part of subcall function 0071912D: GetAsyncKeyState.USER32(00000002), ref: 0071919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00798B6B
ImageList_EndDrag.COMCTL32 ref: 00798B71
ReleaseCapture.USER32 ref: 00798B77
SetWindowTextW.USER32(?,00000000), ref: 00798C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00798C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00798CFF

Strings

@GUI_DRAGFILE, xrefs: 00798C9A
p#}, xrefs: 00798C71
@GUI_DROPID, xrefs: 00798C51

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$p#}
API String ID: 1924731296-1379082668
Opcode ID: a6ad357551e259f9f7f0b98443ebc7d18c0562d9db220b2abc3baa95a6f59f27
Instruction ID: f1e2cf150c3f1dbbbdace53b19adc09c16bddf6dd5f01135b7706758e2bea850
Opcode Fuzzy Hash: a6ad357551e259f9f7f0b98443ebc7d18c0562d9db220b2abc3baa95a6f59f27
Instruction Fuzzy Hash: C7518A71105240EFDB04DF24D86AFAA77E4BB89710F40066EF952572E2CB78A945CB62

Function 00773388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 007733CF

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 007733F0

Strings

^ ERROR , xrefs: 0077349E
Error: , xrefs: 007734D1
"%s" (%d) : ==> %s:, xrefs: 00773522
Line %d (File "%s"):, xrefs: 00773443, 0077345C
Incorrect parameters to object property !, xrefs: 007734AB
"%s" (%d) : ==> %s:%s%s, xrefs: 00773504

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 793f70bca7254a21e338416a88a1f8aba05ba68bc58b5b07346ec15886699b8d
Instruction ID: aa51ea5d01d598275fa91dea30586a66d44d85e1edf511e47c8c8d3dc850a316
Opcode Fuzzy Hash: 793f70bca7254a21e338416a88a1f8aba05ba68bc58b5b07346ec15886699b8d
Instruction Fuzzy Hash: 8B5171B1900209FADF15EBA0CD4AEEEB7B8AF04340F508165F50972092EB3D6F58DB60

Function 0076B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0076B5FC
_wcslen.LIBCMT ref: 0076B608
_wcslen.LIBCMT ref: 0076B64D
_wcslen.LIBCMT ref: 0076B68C
_wcslen.LIBCMT ref: 0076B6C7

Strings

KEYS, xrefs: 0076B647, 0076B64C
APPEND, xrefs: 0076B6C1, 0076B6C6
REMOVE, xrefs: 0076B602, 0076B607
EXISTS, xrefs: 0076B686, 0076B68B

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: e8216b14bb635e1dc2f6943b70f9067b20c48e4fce588913460aab460b248a9d
Instruction ID: 9111635bd56c85edba8e26b66429aa0cd1fe4117225a41069758eb6e418004d3
Opcode Fuzzy Hash: e8216b14bb635e1dc2f6943b70f9067b20c48e4fce588913460aab460b248a9d
Instruction Fuzzy Hash: 8B41D832A00126DBCB105F7DC9905BE77A5AFA2754B24422AEC63D7284E739DDC1C790

Function 00775393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007753A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00775416
GetLastError.KERNEL32 ref: 00775420
SetErrorMode.KERNEL32(00000000,READY), ref: 007754A7

Strings

READONLY, xrefs: 00775452
UNKNOWN, xrefs: 00775444
NOTREADY, xrefs: 0077544B
INVALID, xrefs: 00775459
READY, xrefs: 00775460, 00775468

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 8be2f8123a43640b06fe00de86a36e6f59a33095f815925aeedad927aee3767b
Instruction ID: af0864432465c63b1930fb141332c55fa70db03dbd663425b4af44c4609245f5
Opcode Fuzzy Hash: 8be2f8123a43640b06fe00de86a36e6f59a33095f815925aeedad927aee3767b
Instruction Fuzzy Hash: 9D319075A00544DFDF10DF68C488EAA7BB4EF05345F14C169E50ACB292DBB9DD82CBA1

Function 00793C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00793C79
SetMenu.USER32(?,00000000), ref: 00793C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00793D10
IsMenu.USER32(?), ref: 00793D24
CreatePopupMenu.USER32 ref: 00793D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00793D5B
DrawMenuBar.USER32 ref: 00793D63

Strings

F, xrefs: 00793D4E
0, xrefs: 00793C54

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 2e576dcd6a6ef02a3599bb5f3eeae7fd9af68f667e8f6314f9a407212d6858a6
Instruction ID: 6ae320447d9ef1072051239ab43df6cf57631a2721b709882c81d3eea7a100a6
Opcode Fuzzy Hash: 2e576dcd6a6ef02a3599bb5f3eeae7fd9af68f667e8f6314f9a407212d6858a6
Instruction Fuzzy Hash: 77419CB4A01209EFDF14CFA4E854EAA7BB5FF49300F144029F90697360D738AA10CF94

Function 00761EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

Part of subcall function 00763CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00763CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00761F64
GetDlgCtrlID.USER32 ref: 00761F6F
GetParent.USER32 ref: 00761F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00761F8E
GetDlgCtrlID.USER32(?), ref: 00761F97
GetParent.USER32(?), ref: 00761FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00761FAE

Strings

ComboBox, xrefs: 00761EEC
ListBox, xrefs: 00761F21

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 1f8a805d95d2f9de11bced8bb26901ef9f41509f63ac63b4525433a5f3ec8ef6
Instruction ID: 9ea4d6d30697989cb5be0a174592b18d6e344de085ac1b9207eca5bac25185cb
Opcode Fuzzy Hash: 1f8a805d95d2f9de11bced8bb26901ef9f41509f63ac63b4525433a5f3ec8ef6
Instruction Fuzzy Hash: C821B071900214FBCF05AFA0CC89EEEBBB8AF15310F40419ABA62672E1CB3D5915DB74

Function 00793A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00793A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00793AA0
GetWindowLongW.USER32(?,000000F0), ref: 00793AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00793AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00793B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00793BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00793BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00793BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00793BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00793C13

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 566b7a95fa08955db2acb50a9dd4abbe4b255811645e043bec83866e39ae4851
Instruction ID: 91c06b7cbcb218dbfac336c2110ec729cd2bfb0a0c16ef55cdce3c44152e9bfa
Opcode Fuzzy Hash: 566b7a95fa08955db2acb50a9dd4abbe4b255811645e043bec83866e39ae4851
Instruction Fuzzy Hash: 33618D75900248AFDF10DFA8DC81EEE77F8EB09700F10419AFA15A7292C778AE41DB60

Function 0076B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0076B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0076A1E1,?,00000001), ref: 0076B165
GetWindowThreadProcessId.USER32(00000000), ref: 0076B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0076A1E1,?,00000001), ref: 0076B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0076B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0076A1E1,?,00000001), ref: 0076B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0076A1E1,?,00000001), ref: 0076B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0076A1E1,?,00000001), ref: 0076B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0076A1E1,?,00000001), ref: 0076B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0076A1E1,?,00000001), ref: 0076B21D

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 371782bd641f54103b84ba9e6acc29c49b564ad6edcc7e8ee583bdee30cdffb7
Instruction ID: 0662687e7550a396188cc2f0d647ab8ca77797f13559ba8da457446941a4c448
Opcode Fuzzy Hash: 371782bd641f54103b84ba9e6acc29c49b564ad6edcc7e8ee583bdee30cdffb7
Instruction Fuzzy Hash: 4F319171500204BFDF129F64DC59B6E7BBABB52311F10C016FE02EA290D7BC9A818F69

Function 00732C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00732C94

Part of subcall function 007329C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0073D7D1,00000000,00000000,00000000,00000000,?,0073D7F8,00000000,00000007,00000000,?,0073DBF5,00000000), ref: 007329DE
Part of subcall function 007329C8: GetLastError.KERNEL32(00000000,?,0073D7D1,00000000,00000000,00000000,00000000,?,0073D7F8,00000000,00000007,00000000,?,0073DBF5,00000000,00000000), ref: 007329F0

_free.LIBCMT ref: 00732CA0
_free.LIBCMT ref: 00732CAB
_free.LIBCMT ref: 00732CB6
_free.LIBCMT ref: 00732CC1
_free.LIBCMT ref: 00732CCC
_free.LIBCMT ref: 00732CD7
_free.LIBCMT ref: 00732CE2
_free.LIBCMT ref: 00732CED
_free.LIBCMT ref: 00732CFB

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b9040cbd97578d59a99ac14f30609361fca46113580b29f45fc5f6077a414f31
Instruction ID: 9a37e9b23c3debd017c13d47da197dcb7c683ce73eb933043494eb1eb32587ed
Opcode Fuzzy Hash: b9040cbd97578d59a99ac14f30609361fca46113580b29f45fc5f6077a414f31
Instruction Fuzzy Hash: 0811B276100118EFEB02EF54E886DDD3BA5BF05350F9144A0FA88AB233DA35FA519F90

Function 00701410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00701459
OleUninitialize.OLE32(?,00000000), ref: 007014F8
UnregisterHotKey.USER32(?), ref: 007016DD
DestroyWindow.USER32(?), ref: 007424B9
FreeLibrary.KERNEL32(?), ref: 0074251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0074254B

Strings

close all, xrefs: 00701454

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 313f82d09032166aabb00ec2ad389982c8c444c288e2f9863d73ebac55e268e1
Instruction ID: f225435ddba99d44023a49359209108f4b5b64642c4f2af3381738137a175030
Opcode Fuzzy Hash: 313f82d09032166aabb00ec2ad389982c8c444c288e2f9863d73ebac55e268e1
Instruction Fuzzy Hash: B2D18031701212CFCB19DF14C899A29F7A0BF05710F9542ADF54AAB2A2DB39AD23CF55

Function 00777DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00777FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00777FC1
GetFileAttributesW.KERNEL32(?), ref: 00777FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00778005
SetCurrentDirectoryW.KERNEL32(?), ref: 00778017
SetCurrentDirectoryW.KERNEL32(?), ref: 00778060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 007780B0

Strings

*.*, xrefs: 00778066

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 50d9e9d29c07866ce86b03007f93c5050c0a097674cc496b07a6a91bd983af90
Instruction ID: 781e7670598022521362cd4bff09843be1815367d37e711b734213ad38ddd7b6
Opcode Fuzzy Hash: 50d9e9d29c07866ce86b03007f93c5050c0a097674cc496b07a6a91bd983af90
Instruction Fuzzy Hash: 59818072508201DBDF24DF14C8489AEB3E8BB84394F548D5AF889C7250EBB8DD45CB52

Function 00705BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00705C7A

Part of subcall function 00705D0A: GetClientRect.USER32(?,?), ref: 00705D30
Part of subcall function 00705D0A: GetWindowRect.USER32(?,?), ref: 00705D71
Part of subcall function 00705D0A: ScreenToClient.USER32(?,?), ref: 00705D99

GetDC.USER32 ref: 007446F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00744708
SelectObject.GDI32(00000000,00000000), ref: 00744716
SelectObject.GDI32(00000000,00000000), ref: 0074472B
ReleaseDC.USER32(?,00000000), ref: 00744733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 007447C4

Strings

U, xrefs: 00744693

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 01ced1be421c417efe3bf49b2e4490d4aa30492b99a50b5dc3982c444ee6c55d
Instruction ID: 1a3a3360f3b5458a92acf78aa15df67251ca1925075cea4115a6e8ffc0e90ff2
Opcode Fuzzy Hash: 01ced1be421c417efe3bf49b2e4490d4aa30492b99a50b5dc3982c444ee6c55d
Instruction Fuzzy Hash: DD710331500205EFDF22CF64C984BBA7BB5FF4A360F14426AED555A1A6C7399C42EF60

Function 0077359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 007735E4

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

LoadStringW.USER32(007D2390,?,00000FFF,?), ref: 0077360A

Strings

Error: , xrefs: 007736EF
^ ERROR, xrefs: 007736C9
"%s" (%d) : ==> %s:, xrefs: 00773742
Line %d (File "%s"):, xrefs: 0077366B
"%s" (%d) : ==> %s:%s%s, xrefs: 00773724

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 943bd6ede070ebb765a73c95dfde27c6226cb18376d12cd1e48965aa75394f6f
Instruction ID: fb9cee9bd097e718651a352fa0db8eea7f07ed09ca152bf12c02ff13458ae9c8
Opcode Fuzzy Hash: 943bd6ede070ebb765a73c95dfde27c6226cb18376d12cd1e48965aa75394f6f
Instruction Fuzzy Hash: 66516471900209FBDF15EBA0DC86EEEBB78AF04340F548225F60572192DB395B99DFA0

Function 0077C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0077C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0077C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0077C2CA
GetLastError.KERNEL32 ref: 0077C322
SetEvent.KERNEL32(?), ref: 0077C336
InternetCloseHandle.WININET(00000000), ref: 0077C341

Strings

, xrefs: 0077C2BB

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: aea63bd4bee8bd737e90b68408c9089bf6596a50cde1fa72cb8dc72b3345f708
Instruction ID: 86e84460bb798a8c5b84877324a6fad6dddbb079dd7092f0450bfb450244f267
Opcode Fuzzy Hash: aea63bd4bee8bd737e90b68408c9089bf6596a50cde1fa72cb8dc72b3345f708
Instruction Fuzzy Hash: 50317FB1500604AFDF229FA48C88AAB7BFCFB49784F14C51EF44AD2201DB38DD059B65

Function 0076989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00743AAF,?,?,Bad directive syntax error,0079CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 007698BC
LoadStringW.USER32(00000000,?,00743AAF,?), ref: 007698C3

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00769987

Strings

., xrefs: 0076996D
Line %d:, xrefs: 00769912
Error: , xrefs: 00769955
Line %d (File "%s"):, xrefs: 0076992D
%s (%d) : ==> %s.: %s %s, xrefs: 007698F1

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: f76431c3245770f24bf860a1ab1a9986a5f7c55ce6f5a323f8c4b5f66621c547
Instruction ID: a6706b96b3e10546827e5a147f60ec1f150f605ad921ed31f0ef8f01900f682b
Opcode Fuzzy Hash: f76431c3245770f24bf860a1ab1a9986a5f7c55ce6f5a323f8c4b5f66621c547
Instruction Fuzzy Hash: B4218071C0025AEBDF15EF90CC4AEEE7779BF18300F04445AF619620E2EB39A658DB20

Function 0076209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 007620AB
GetClassNameW.USER32(00000000,?,00000100), ref: 007620C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0076214D

Strings

largeicons, xrefs: 007620E1
list, xrefs: 0076212F
smallicons, xrefs: 00762115
SHELLDLL_DefView, xrefs: 007620CC
details, xrefs: 007620FB

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 40a4c77f65397e3a523e6081014e9edf8ad98e47e121d069eef11e9127521523
Instruction ID: 8c7bab936c5e04ae6ab28f019023c00c0d0482e5019e22da7c1779127b7729e0
Opcode Fuzzy Hash: 40a4c77f65397e3a523e6081014e9edf8ad98e47e121d069eef11e9127521523
Instruction Fuzzy Hash: 7D113DF628CB0AF6FA056624EC0ADA6379CCB05314B20401AFF05B40D2FE6D6C435514

Function 0073CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0073CEB7
_free.LIBCMT ref: 0073CF22
_free.LIBCMT ref: 0073CF48
_free.LIBCMT ref: 0073CF71
_free.LIBCMT ref: 0073CFA9
_free.LIBCMT ref: 0073CFDA
_free.LIBCMT ref: 0073D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0073D09C
_free.LIBCMT ref: 0073D0B5

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: b43e0867dd5a04f962838faf4ca12871b7bb29490e693af1d880e8f4c42ecf60
Instruction ID: 1b83e8fd75c208b727fe098ea767d470715c80e15d9b8c2f163682fc37e65928
Opcode Fuzzy Hash: b43e0867dd5a04f962838faf4ca12871b7bb29490e693af1d880e8f4c42ecf60
Instruction Fuzzy Hash: 37612772A05316AFFB26AFB4A889B697BA5EF05310F14416EF940B7243D73E9D01C790

Function 007950D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00795186
ShowWindow.USER32(?,00000000), ref: 007951C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 007951CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 007951D1

Part of subcall function 00796FBA: DeleteObject.GDI32(00000000), ref: 00796FE6

GetWindowLongW.USER32(?,000000F0), ref: 0079520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0079521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0079524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00795287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00795296

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 5ac2116631cf3faca1af78fd9fa83dc01877ec93a93a4ad489727ba4844e71c7
Instruction ID: c509e34332ffb2fa457772367390a39dfc840b31f3b83d90c447fc29a141227e
Opcode Fuzzy Hash: 5ac2116631cf3faca1af78fd9fa83dc01877ec93a93a4ad489727ba4844e71c7
Instruction Fuzzy Hash: BC51B270A80A2CFFEF269F28EC49BD83B65FB05321F148112F615962E0C37DA981DB41

Function 00718B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00756890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 007568A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 007568B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 007568D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 007568F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00718874,00000000,00000000,00000000,000000FF,00000000), ref: 00756901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0075691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00718874,00000000,00000000,00000000,000000FF,00000000), ref: 0075692D

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: b0323ed22748e5a3ed477028e6b873e5b7cfca3f5644639d4352d8c7a2da4d98
Instruction ID: bd9dbc32156defdf02772f9f28c06e4ba1bdd16fd50348c75a14a9c8ab4e3ff5
Opcode Fuzzy Hash: b0323ed22748e5a3ed477028e6b873e5b7cfca3f5644639d4352d8c7a2da4d98
Instruction Fuzzy Hash: 37518BB0600209EFDB20CF28CC55BAA7BB5FF54751F144519F906972E0DBB8E991DB50

Function 0077C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0077C182
GetLastError.KERNEL32 ref: 0077C195
SetEvent.KERNEL32(?), ref: 0077C1A9

Part of subcall function 0077C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0077C272
Part of subcall function 0077C253: GetLastError.KERNEL32 ref: 0077C322
Part of subcall function 0077C253: SetEvent.KERNEL32(?), ref: 0077C336
Part of subcall function 0077C253: InternetCloseHandle.WININET(00000000), ref: 0077C341

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: ecb816931360ce5b0881f0980032e7c03352ecea6cf0413e75ab8916d0bbd872
Instruction ID: 0dcbd8bd46c2b5aea8c664b01dedfe2efd1d171a3491c4a91affbfdc577ac6f2
Opcode Fuzzy Hash: ecb816931360ce5b0881f0980032e7c03352ecea6cf0413e75ab8916d0bbd872
Instruction Fuzzy Hash: 3B318B71200605EFDF229FA5DC48A66BBF8FF1C380B54C42EF95A86611D738E9159BA0

Function 007625A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00763A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00763A57
Part of subcall function 00763A3D: GetCurrentThreadId.KERNEL32 ref: 00763A5E
Part of subcall function 00763A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007625B3), ref: 00763A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 007625BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 007625DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 007625DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 007625E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00762601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00762605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0076260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00762623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00762627

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: af1a792166d00a1640fc2826904b35587b3536f5c1ee58ff2450e93408ee5158
Instruction ID: 72ace2a315746c4db0fc055b21e850490b482fd1d1578699c1ee325205ae23fb
Opcode Fuzzy Hash: af1a792166d00a1640fc2826904b35587b3536f5c1ee58ff2450e93408ee5158
Instruction Fuzzy Hash: FB012430380614BBFB206768CC8EF593F59DF4EB12F104002F319AE1D1C9EA2842CA6E

Function 00761803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00761449,?,?,00000000), ref: 0076180C
HeapAlloc.KERNEL32(00000000,?,00761449,?,?,00000000), ref: 00761813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00761449,?,?,00000000), ref: 00761828
GetCurrentProcess.KERNEL32(?,00000000,?,00761449,?,?,00000000), ref: 00761830
DuplicateHandle.KERNEL32(00000000,?,00761449,?,?,00000000), ref: 00761833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00761449,?,?,00000000), ref: 00761843
GetCurrentProcess.KERNEL32(00761449,00000000,?,00761449,?,?,00000000), ref: 0076184B
DuplicateHandle.KERNEL32(00000000,?,00761449,?,?,00000000), ref: 0076184E
CreateThread.KERNEL32(00000000,00000000,00761874,00000000,00000000,00000000), ref: 00761868

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 1524fa56dd6935361ffe9b6e578538e27e7bc9485055b3e8ff4827eeb1197ddb
Instruction ID: 9bdafcee03ee2c1d6ee44c7858b1303a22b23b48e30ee95042ba37c6a583797c
Opcode Fuzzy Hash: 1524fa56dd6935361ffe9b6e578538e27e7bc9485055b3e8ff4827eeb1197ddb
Instruction Fuzzy Hash: D501BFB5280308BFEB11AB65DD4EF5B3B6CEB89B11F418411FA05DB2A1C6749C01CB38

Function 00733E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00733F0B
__alldvrm.LIBCMT ref: 0073410C
__alldvrm.LIBCMT ref: 0073412E

Strings

}}r, xrefs: 00733E96, 00733EF1, 00733F0A, 00734090
}}r, xrefs: 00733E8A
}}r, xrefs: 007340CD

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}r$}}r$}}r
API String ID: 1036877536-270397269
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: e1d6008426b39e44bdec7731840a4c03e0b1b932bbce143d7201a28d917f26b4
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: E4A14972E007969FFB29CF18C8917AEBBE4EF61350F1441ADE5859B283D23CA981C750

Function 0078A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0076D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0076D501
Part of subcall function 0076D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0076D50F
Part of subcall function 0076D4DC: CloseHandle.KERNEL32(00000000), ref: 0076D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0078A16D
GetLastError.KERNEL32 ref: 0078A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0078A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0078A268
GetLastError.KERNEL32(00000000), ref: 0078A273
CloseHandle.KERNEL32(00000000), ref: 0078A2C4

Strings

SeDebugPrivilege, xrefs: 0078A18F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 69679fc5eb461295cb89b76cfa4c2104303c95d09350a910b6f70b8cb89171bb
Instruction ID: 096be58c811eeb525ba03f124287e4ebeebce6033267d7f733d79f149ced5d64
Opcode Fuzzy Hash: 69679fc5eb461295cb89b76cfa4c2104303c95d09350a910b6f70b8cb89171bb
Instruction Fuzzy Hash: C1619F71244242EFE721EF18C498F15BBE1AF44318F18859DE4668B7A3C77AEC45CB92

Function 00793886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00793925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0079393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00793954
_wcslen.LIBCMT ref: 00793999
SendMessageW.USER32(?,00001057,00000000,?), ref: 007939C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 007939F4

Strings

SysListView32, xrefs: 007938F7

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 6e6b22754c975e2b38d2f77487a8357933ff1537d1964c940c67a6bfb79a54a3
Instruction ID: db73e622d36e9e1a18a04389d29e5301e7f10bca81ed0c3199df42db78f75a2b
Opcode Fuzzy Hash: 6e6b22754c975e2b38d2f77487a8357933ff1537d1964c940c67a6bfb79a54a3
Instruction Fuzzy Hash: 8641B671A00219ABEF21DF64DC49FEA7BA9EF08354F10056AF958E7281D7799D80CB90

Function 0076BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0076BCFD
IsMenu.USER32(00000000), ref: 0076BD1D
CreatePopupMenu.USER32 ref: 0076BD53
GetMenuItemCount.USER32(010C5420), ref: 0076BDA4
InsertMenuItemW.USER32(010C5420,?,00000001,00000030), ref: 0076BDCC

Strings

2, xrefs: 0076BD37
0, xrefs: 0076BCA8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: e3774e3db9fa0e10dda7833a11132713e529f172f2b0ed5401c34f743383444f
Instruction ID: ff5a6ab8614ce2057f260615b342235a7b177383e9425aa93349a9c3adb77b0a
Opcode Fuzzy Hash: e3774e3db9fa0e10dda7833a11132713e529f172f2b0ed5401c34f743383444f
Instruction Fuzzy Hash: B451A270700205DBDF11CFA8D888BAEBBF8BF46314F248159EC52DB291D778A981CB61

Function 00722D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00722D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00722D53
_ValidateLocalCookies.LIBCMT ref: 00722DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00722E0C
_ValidateLocalCookies.LIBCMT ref: 00722E61

Strings

&Hr, xrefs: 00722DFE, 00722E07, 00722E18
csm, xrefs: 00722DF6

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &Hr$csm
API String ID: 1170836740-2624131954
Opcode ID: 37ac7fd3d945a1a42cd87fe80ca86722f841a8e228d9abb5e35e400245ae8da7
Instruction ID: 86847963db5a3abc110eb6568490f66add2d6c23c55c3b7c64a5667e71d44738
Opcode Fuzzy Hash: 37ac7fd3d945a1a42cd87fe80ca86722f841a8e228d9abb5e35e400245ae8da7
Instruction Fuzzy Hash: 9E418334E00229FBCF10DF68D849A9EBBA5BF45324F148155E8156B353D739EA46CBD0

Function 0076C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0076C913

Strings

blank, xrefs: 0076C895
warning, xrefs: 0076C8FC
info, xrefs: 0076C8B4
stop, xrefs: 0076C8E4
question, xrefs: 0076C8CC

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: a71c3ee1a32fd73c004c423391a342e2b060e9879d1d73195fb7c204b1048413
Instruction ID: b8626778817fa9e7e30473f6ac74a8b68f062933c328ec9b63f7d807d388e3f2
Opcode Fuzzy Hash: a71c3ee1a32fd73c004c423391a342e2b060e9879d1d73195fb7c204b1048413
Instruction Fuzzy Hash: 3B11EB31689307BEE7079B54EC82DBA77ACDF15354B10442FFD45B6182E77C6D005268

Function 0076DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0076DE42
gethostname.WSOCK32(?,00000100), ref: 0076DE5C
gethostbyname.WSOCK32(?), ref: 0076DE69
inet_ntoa.WSOCK32(?), ref: 0076DEAB
_strcat.LIBCMT ref: 0076DEB9
WSACleanup.WSOCK32 ref: 0076DEDE

Strings

0.0.0.0, xrefs: 0076DE87

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: cf5683fe0da34b6998d90f37c3a4ed6195c4dffbdce1556a7a9011853cbf6ded
Instruction ID: d833590ab3da01810a5ae7bcfe0306972a1111f1441d118aaf8dfe9b8d79b79e
Opcode Fuzzy Hash: cf5683fe0da34b6998d90f37c3a4ed6195c4dffbdce1556a7a9011853cbf6ded
Instruction Fuzzy Hash: C2110A71A14114EFCF31AB60AC4EEDE77ACDF11710F04016AF94696091EFBD9E818AA0

Function 0076ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0076ED2A
_wcslen.LIBCMT ref: 0076ED3B
_wcslen.LIBCMT ref: 0076ED79
_wcslen.LIBCMT ref: 0076EDAF
_wcslen.LIBCMT ref: 0076EDDF
_wcslen.LIBCMT ref: 0076EDEF
_wcslen.LIBCMT ref: 0076EE2B
_wcslen.LIBCMT ref: 0076EE5A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 7363f1402170ffaffbd9d018d4c138f2778207ea2bbb089029ab747344389db5
Instruction ID: 856d120efab0fbac2be38d14af8a2106b9973fd9f608d536046476692f565d09
Opcode Fuzzy Hash: 7363f1402170ffaffbd9d018d4c138f2778207ea2bbb089029ab747344389db5
Instruction Fuzzy Hash: B341A266C10228F5DB11EBF4988E9CFB7E8AF45310F508466E919E3122FB3CE645C3A5

Function 0071F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0075682C,00000004,00000000,00000000), ref: 0071F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0075682C,00000004,00000000,00000000), ref: 0075F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0075682C,00000004,00000000,00000000), ref: 0075F454

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 16ede3885e1125f0e1d0d12aafc572aba65ad09fee0d60466ca543d8a49bd690
Instruction ID: e9a27ea539262d2f1763f259456e58b12cc118c852ba33a1bed6a4ffff9446cd
Opcode Fuzzy Hash: 16ede3885e1125f0e1d0d12aafc572aba65ad09fee0d60466ca543d8a49bd690
Instruction Fuzzy Hash: 03413B31608680BEDB35BB2DC8887EA7B91AB46321F58843DE447D65E0C67DB8C5CB11

Function 00792D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00792D1B
GetDC.USER32(00000000), ref: 00792D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00792D2E
ReleaseDC.USER32(00000000,00000000), ref: 00792D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00792D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00792D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00795A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00792DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00792DE1

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 634a25489a0ee486c357d5b6ae2562c5c8226bba9c19b8c4e56a19ec79c71448
Instruction ID: 8447b848d35725bca33094112023729ee1646bf39fcc83938b6d65f7ed034ba6
Opcode Fuzzy Hash: 634a25489a0ee486c357d5b6ae2562c5c8226bba9c19b8c4e56a19ec79c71448
Instruction Fuzzy Hash: 8C317C72201214BFEF158F54DC8AFEB3BA9EF09715F048056FE089A291C6799C52CBB4

Function 00765622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00765637
_memcmp.LIBVCRUNTIME ref: 00765659
_memcmp.LIBVCRUNTIME ref: 00765671
_memcmp.LIBVCRUNTIME ref: 00765684
_memcmp.LIBVCRUNTIME ref: 0076569E
_memcmp.LIBVCRUNTIME ref: 007656B1
_memcmp.LIBVCRUNTIME ref: 007656C9
_memcmp.LIBVCRUNTIME ref: 007656E4

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: e6f01c9c9030353040ce0c36037365731a0eec829abc133864cb8e94b6b38a87
Instruction ID: fd8a5b8d7bc634fa574ad40e795c532d3b4e672e625b11998e9445ed9b85020e
Opcode Fuzzy Hash: e6f01c9c9030353040ce0c36037365731a0eec829abc133864cb8e94b6b38a87
Instruction Fuzzy Hash: F821CCA1640915B7D6149520ED86FFA335DBF31794F444020FD06AA642F72CEE24D6B5

Function 00784FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00785007
NULL Pointer assignment, xrefs: 0078502E, 00785383

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 0ebbd8157db70abeb6a967f3f5be907e1976f614eb9be7c1438e03f0f0b52d0a
Instruction ID: 5c31be95a8aaa73bb6def6554f9cd20013f1b4b2d34658536c01af1e5f5df815
Opcode Fuzzy Hash: 0ebbd8157db70abeb6a967f3f5be907e1976f614eb9be7c1438e03f0f0b52d0a
Instruction Fuzzy Hash: 5CD1D271A4060A9FDF10DFA8C885BAEB7B5BF48354F148069E915EB281E774DD41CB90

Function 00741522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 007415CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00741651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 007416E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 007416FB

Part of subcall function 00733820: RtlAllocateHeap.NTDLL(00000000,?,007D1444,?,0071FDF5,?,?,0070A976,00000010,007D1440,007013FC,?,007013C6,?,00701129), ref: 00733852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00741777
__freea.LIBCMT ref: 007417A2
__freea.LIBCMT ref: 007417AE

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: d028e08f0a2608723cf43bd6b84ec53d629271b46ecf59ad797cc1182c3d7d4d
Instruction ID: dd5dfa483631979d1a5633e182ef60e48ee0e4db5ce0b9307b59cd1dbf559466
Opcode Fuzzy Hash: d028e08f0a2608723cf43bd6b84ec53d629271b46ecf59ad797cc1182c3d7d4d
Instruction Fuzzy Hash: 1491D571E002169ADF21AE74CC85AFEBBB59F49350F984659E805E7141EB3DCDC0CB61

Function 00784523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00784648
VariantInit.OLEAUT32(?), ref: 00784749
VariantClear.OLEAUT32(?), ref: 00784753
VariantClear.OLEAUT32(?), ref: 007847B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 007845D8, 00784706, 007847BE
Incorrect Object type in FOR..IN loop, xrefs: 0078472C

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 6ad9e57847a2249789c02356c935d5607fcf07babff97f1b4eba87a5971573c1
Instruction ID: 9475ae0a1b7d8a4a4ee42fc002dd593fcab466cf7a9d1378545add5c79838c91
Opcode Fuzzy Hash: 6ad9e57847a2249789c02356c935d5607fcf07babff97f1b4eba87a5971573c1
Instruction Fuzzy Hash: 65918171A4021AEBDF24DFA5CC48FAEBBB8EF45710F108559F515AB280D7B89941CFA0

Function 00771187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0077125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00771284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 007712A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 007712D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0077135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 007713C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00771430

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 1f77921778030368cadddfeced47924483f98626fde757d61fd358dabd9ef805
Instruction ID: ae14ca0562d77cd7ce8b16b9940ddfeb7ddff0c1689ccc5c99bf531b8ebc9169
Opcode Fuzzy Hash: 1f77921778030368cadddfeced47924483f98626fde757d61fd358dabd9ef805
Instruction Fuzzy Hash: A891BF71A00219EFDF019FA8C888BBE77B5FF45365F548029E944EB292D77CA941CB90

Function 0071948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e25ce3f8d63f0b8efca2aa2306a87d59838fd51a6805274f9aaa64cac7a6efc8
Instruction ID: a50ad4e5b81404171015228779d232f2db695937a4981d597695a681cc57091c
Opcode Fuzzy Hash: e25ce3f8d63f0b8efca2aa2306a87d59838fd51a6805274f9aaa64cac7a6efc8
Instruction Fuzzy Hash: 33914D71D00219EFCB15CFA9CC84AEEBBB9FF49320F148055E915B7291D378A992CB60

Function 00783947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0078396B
CharUpperBuffW.USER32(?,?), ref: 00783A7A
_wcslen.LIBCMT ref: 00783A8A
VariantClear.OLEAUT32(?), ref: 00783C1F

Part of subcall function 00770CDF: VariantInit.OLEAUT32(00000000), ref: 00770D1F
Part of subcall function 00770CDF: VariantCopy.OLEAUT32(?,?), ref: 00770D28
Part of subcall function 00770CDF: VariantClear.OLEAUT32(?), ref: 00770D34

Strings

AUTOIT.ERROR, xrefs: 00783A80, 00783A85
Incorrect Parameter format, xrefs: 007839A6, 00783BA1

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: a6c8a2854e439df2f33c576e051b1f7516ae8c4a160d6ad73a12124c35284b0d
Instruction ID: 3d67220ff4e0e3f63282623901eaf05152ae29c8cc574039fb1d4eb5d663af5b
Opcode Fuzzy Hash: a6c8a2854e439df2f33c576e051b1f7516ae8c4a160d6ad73a12124c35284b0d
Instruction Fuzzy Hash: 02913875608305DFCB04EF28C48596ABBE4BF88714F14892DF88997391DB39EE45CB92

Function 00784BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0076000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0075FF41,80070057,?,?,?,0076035E), ref: 0076002B
Part of subcall function 0076000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0075FF41,80070057,?,?), ref: 00760046
Part of subcall function 0076000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0075FF41,80070057,?,?), ref: 00760054
Part of subcall function 0076000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0075FF41,80070057,?), ref: 00760064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00784C51
_wcslen.LIBCMT ref: 00784D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00784DCF
CoTaskMemFree.OLE32(?), ref: 00784DDA

Strings

NULL Pointer assignment, xrefs: 00784E23, 00784E52

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 7aa1165678ecc16e13d6f0bea89fa5a2a6c96702d47229824835f80e6e17eb08
Instruction ID: 6f7b19eac0b6b5fb17e2374ac4fa77d202f97e02c2f9f6ef3f70e982cc288637
Opcode Fuzzy Hash: 7aa1165678ecc16e13d6f0bea89fa5a2a6c96702d47229824835f80e6e17eb08
Instruction Fuzzy Hash: 75912A71D00219EFDF11EFA4D894AEEB7B8BF08310F108269E915A7281DB785A45CF60

Function 007920FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00792183
GetMenuItemCount.USER32(00000000), ref: 007921B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 007921DD
_wcslen.LIBCMT ref: 00792213
GetMenuItemID.USER32(?,?), ref: 0079224D
GetSubMenu.USER32(?,?), ref: 0079225B

Part of subcall function 00763A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00763A57
Part of subcall function 00763A3D: GetCurrentThreadId.KERNEL32 ref: 00763A5E
Part of subcall function 00763A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007625B3), ref: 00763A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 007922E3

Part of subcall function 0076E97B: Sleep.KERNELBASE ref: 0076E9F3

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 6443ce4b65b7997d7fddefecd920d56dd1c9367ab4ac944c95ef6779d9daed07
Instruction ID: c02da691e3880042b75ef810b8381c8a7299fce56361038d4af54761d0493522
Opcode Fuzzy Hash: 6443ce4b65b7997d7fddefecd920d56dd1c9367ab4ac944c95ef6779d9daed07
Instruction Fuzzy Hash: 21715E75A00205EFCF15EF64D845AAEB7F5FF48310F158459E816EB352DB38AD428B90

Function 00797E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(010C5740), ref: 00797F37
IsWindowEnabled.USER32(010C5740), ref: 00797F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0079801E
SendMessageW.USER32(010C5740,000000B0,?,?), ref: 00798051
IsDlgButtonChecked.USER32(?,?), ref: 00798089
GetWindowLongW.USER32(010C5740,000000EC), ref: 007980AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 007980C3

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: ab8617c75501a227bc2ec66555b752a0bed6ee2e5cc75cb78ba0d129716a10eb
Instruction ID: 7b6af5d92a5194524afe9d6761faecc37f0253f289e19a4e768f6db70cbf832d
Opcode Fuzzy Hash: ab8617c75501a227bc2ec66555b752a0bed6ee2e5cc75cb78ba0d129716a10eb
Instruction Fuzzy Hash: 6B71A234608244EFEF25DF54E895FBA7BB6EF0A300F14405AE94567261CB39A846DB21

Function 0076AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0076AEF9
GetKeyboardState.USER32(?), ref: 0076AF0E
SetKeyboardState.USER32(?), ref: 0076AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0076AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0076AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0076AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0076B020

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 83b52e91c038923cc1081deaac57c98e248eb650b1b3fd8534e5b6aba425f987
Instruction ID: 38061849984ea82d457facf333d4095ea81d26e52839b3df763786fe5f66a104
Opcode Fuzzy Hash: 83b52e91c038923cc1081deaac57c98e248eb650b1b3fd8534e5b6aba425f987
Instruction Fuzzy Hash: E951B3A0A047D53DFB3642348C45BBA7EE96B06304F088589F9D6A54C3D3ADECC8DB52

Function 0076ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0076AD19
GetKeyboardState.USER32(?), ref: 0076AD2E
SetKeyboardState.USER32(?), ref: 0076AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0076ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0076ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0076AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0076AE38

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: fb4257d74755fe0b486cf08a0090c690ab8b9fa7343b5e664331cdfdc5436bdd
Instruction ID: 6a6fab3277803ee8febed0b741f77a8699fb2f951c94c90773093c111336971f
Opcode Fuzzy Hash: fb4257d74755fe0b486cf08a0090c690ab8b9fa7343b5e664331cdfdc5436bdd
Instruction Fuzzy Hash: CD51D6B16047D53DFB3783348C96B7A7EE86B46300F088589E5D6668C2D39DEC84DB62

Function 0073542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00743CD6,?,?,?,?,?,?,?,?,00735BA3,?,?,00743CD6,?,?), ref: 00735470
__fassign.LIBCMT ref: 007354EB
__fassign.LIBCMT ref: 00735506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00743CD6,00000005,00000000,00000000), ref: 0073552C
WriteFile.KERNEL32(?,00743CD6,00000000,00735BA3,00000000,?,?,?,?,?,?,?,?,?,00735BA3,?), ref: 0073554B
WriteFile.KERNEL32(?,?,00000001,00735BA3,00000000,?,?,?,?,?,?,?,?,?,00735BA3,?), ref: 00735584

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: afac1b2e4488387c438565d641b8b2be129364a09d1d5a2199b2825f9d4e9621
Instruction ID: 87f9fa225ae789eb4890d3a1874c91534ba8984b1d42f21f0913e5e24a915642
Opcode Fuzzy Hash: afac1b2e4488387c438565d641b8b2be129364a09d1d5a2199b2825f9d4e9621
Instruction Fuzzy Hash: 4951D6709006499FEF11CFA8D845AEEBBFAEF08300F14451AF555E7292E734AA51CB64

Function 007810B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0078304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0078307A
Part of subcall function 0078304E: _wcslen.LIBCMT ref: 0078309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00781112
WSAGetLastError.WSOCK32 ref: 00781121
WSAGetLastError.WSOCK32 ref: 007811C9
closesocket.WSOCK32(00000000), ref: 007811F9

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 613885c8a55c78b3e7bc4c1ba64b11dd8d3abdf6e13c1ead75a50e92e894f141
Instruction ID: a5c8a2407afab7c99b07a49fe6686a3c209f730ee094fd908448eafd70813fe6
Opcode Fuzzy Hash: 613885c8a55c78b3e7bc4c1ba64b11dd8d3abdf6e13c1ead75a50e92e894f141
Instruction Fuzzy Hash: C541E531A00208EFDB11AF54CC88BA9B7E9EF45364F548159FD159B291C778ED42CBE1

Function 0076CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0076DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0076CF22,?), ref: 0076DDFD

Part of subcall function 0076DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0076CF22,?), ref: 0076DE16

lstrcmpiW.KERNEL32(?,?), ref: 0076CF45
MoveFileW.KERNEL32(?,?), ref: 0076CF7F
_wcslen.LIBCMT ref: 0076D005
_wcslen.LIBCMT ref: 0076D01B
SHFileOperationW.SHELL32(?), ref: 0076D061

Strings

\*.*, xrefs: 0076CFF3

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: a31319cc12bf3a3c1b9cbad2caedf022ab882e4d027cfc00099763845dc336bb
Instruction ID: ee4e20eb40895ec412b8c3cf5ec803f99d8f593502c14c3306f20c78547e1f2b
Opcode Fuzzy Hash: a31319cc12bf3a3c1b9cbad2caedf022ab882e4d027cfc00099763845dc336bb
Instruction Fuzzy Hash: C1415772D45118DFDF17EBA4D985AEEB7B9AF08380F0400E6E546E7141EB38AA85CB50

Function 00792DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00792E1C
GetWindowLongW.USER32(?,000000F0), ref: 00792E4F
GetWindowLongW.USER32(?,000000F0), ref: 00792E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00792EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00792EE0
GetWindowLongW.USER32(?,000000F0), ref: 00792EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00792F0B

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: d62fb6fe19a55d69c8a31a47a5a84cdcd25bf12174366ecfddbbb910f09393cd
Instruction ID: 9b81114319757fa9c3182780e653615d8fc38ca14d53f91808aa87099f4393c5
Opcode Fuzzy Hash: d62fb6fe19a55d69c8a31a47a5a84cdcd25bf12174366ecfddbbb910f09393cd
Instruction Fuzzy Hash: 18311235605240AFEF21EF18ECD8F6537E1EB8A710F5541A6F9008B2B2CB79A842DB54

Function 00767726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00767769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0076778F
SysAllocString.OLEAUT32(00000000), ref: 00767792
SysAllocString.OLEAUT32(?), ref: 007677B0
SysFreeString.OLEAUT32(?), ref: 007677B9
StringFromGUID2.OLE32(?,?,00000028), ref: 007677DE
SysAllocString.OLEAUT32(?), ref: 007677EC

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 62baeb34b807c6bd2444922d70efb0e77810ecbf869729bf2e4e951f1ec217ef
Instruction ID: 82e9e613b198c458651b086f0c10739708f55113cc1c9279bb6a8b08fc0a81e1
Opcode Fuzzy Hash: 62baeb34b807c6bd2444922d70efb0e77810ecbf869729bf2e4e951f1ec217ef
Instruction Fuzzy Hash: 1E21A476604219AFDF14DFA8CD88CBB77ACEB097A87048026FD15DB1A0D678DC46C764

Function 007677FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00767842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00767868
SysAllocString.OLEAUT32(00000000), ref: 0076786B
SysAllocString.OLEAUT32 ref: 0076788C
SysFreeString.OLEAUT32 ref: 00767895
StringFromGUID2.OLE32(?,?,00000028), ref: 007678AF
SysAllocString.OLEAUT32(?), ref: 007678BD

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 7cb42348945cf0606434beee26cb700e19da46cd9bf72778b706cda4b74f0fd3
Instruction ID: 3c4e39ace994e4506a9051f4e89494a09035c0acaeb937cb69d78239e7a14568
Opcode Fuzzy Hash: 7cb42348945cf0606434beee26cb700e19da46cd9bf72778b706cda4b74f0fd3
Instruction Fuzzy Hash: 16218371608205AFDF159FB8DC8CDBA77ECEB097A47108125F916CB2A1D678DC81CB68

Function 007704D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 007704F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0077052E

Strings

nul, xrefs: 00770567

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 393eefed977f07443e1da7fd0f0839726d6be4a1ac14c9049cb77de0d6e13f04
Instruction ID: 08b1348864056007d19c232c1d54f191e9ffc4479ebf9d4d99c8d90572391ade
Opcode Fuzzy Hash: 393eefed977f07443e1da7fd0f0839726d6be4a1ac14c9049cb77de0d6e13f04
Instruction Fuzzy Hash: 1D218071500305EBDF208F29DC48EAA7BA4BF447A4F208A19F8A5D62E0D7749961CFA0

Function 007705A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 007705C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00770601

Strings

nul, xrefs: 00770639

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: cf9a7c2043555fa2313a3f5afc306594ce3ae1e146afdf7260f1724c46454160
Instruction ID: ac21eb5a40579afe1ddfcee62530e6b7bf31fe43ab2b60646ece80bd767b2e7b
Opcode Fuzzy Hash: cf9a7c2043555fa2313a3f5afc306594ce3ae1e146afdf7260f1724c46454160
Instruction Fuzzy Hash: D821E275500305DBDF208F68CC58A9A77F4BF817A4F208B1AF8A5E32E0D7749861CBA4

Function 007940AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0070600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0070604C
Part of subcall function 0070600E: GetStockObject.GDI32(00000011), ref: 00706060
Part of subcall function 0070600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0070606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00794112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0079411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0079412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00794139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00794145

Strings

Msctls_Progress32, xrefs: 007940E3

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 31c1d960b0f7fe293cb14e9f6f54f6910cebc974319be4a96ccd02b248e8f6f1
Instruction ID: 071d2feac6439bcdefa54fb2b79bb614369b080eded4cb0fd1a915324d38f903
Opcode Fuzzy Hash: 31c1d960b0f7fe293cb14e9f6f54f6910cebc974319be4a96ccd02b248e8f6f1
Instruction Fuzzy Hash: 8611B6B214011DBEEF119F64CC85EE77F9DEF08798F004111B618A2050C6769C21DBA4

Function 0073D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0073D7A3: _free.LIBCMT ref: 0073D7CC

_free.LIBCMT ref: 0073D82D

Part of subcall function 007329C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0073D7D1,00000000,00000000,00000000,00000000,?,0073D7F8,00000000,00000007,00000000,?,0073DBF5,00000000), ref: 007329DE
Part of subcall function 007329C8: GetLastError.KERNEL32(00000000,?,0073D7D1,00000000,00000000,00000000,00000000,?,0073D7F8,00000000,00000007,00000000,?,0073DBF5,00000000,00000000), ref: 007329F0

_free.LIBCMT ref: 0073D838
_free.LIBCMT ref: 0073D843
_free.LIBCMT ref: 0073D897
_free.LIBCMT ref: 0073D8A2
_free.LIBCMT ref: 0073D8AD
_free.LIBCMT ref: 0073D8B8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: fc3db54e2e92da4916d785b2e6e36beaa2d6b9f440e9d37746bb7a850f88d83e
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 95111F71940B14EAF531BFB0EC4BFCB7BDC6F04700F404825B699A65A3DB69B9064A50

Function 0076DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0076DA74
LoadStringW.USER32(00000000), ref: 0076DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0076DA91
LoadStringW.USER32(00000000), ref: 0076DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0076DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0076DAB9

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 69addeb2120887efefea288a6b628b731506ca1e4bbf5d25079a6f7a538bba93
Instruction ID: 4ee65b4c91f294eaa2fecd41a5e0bdc6a2314772055f65702d922af6b517344e
Opcode Fuzzy Hash: 69addeb2120887efefea288a6b628b731506ca1e4bbf5d25079a6f7a538bba93
Instruction Fuzzy Hash: 490112F69442087FEB11DBE49D89EE7776CE708701F408496B746E2041E6789E854F78

Function 0077096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(010BEBE0,010BEBE0), ref: 0077097B
EnterCriticalSection.KERNEL32(010BEBC0,00000000), ref: 0077098D
TerminateThread.KERNEL32(?,000001F6), ref: 0077099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 007709A9
CloseHandle.KERNEL32(?), ref: 007709B8
InterlockedExchange.KERNEL32(010BEBE0,000001F6), ref: 007709C8
LeaveCriticalSection.KERNEL32(010BEBC0), ref: 007709CF

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 70873c22a785b7e3d114070329d23f6d0f946579c7b0f2ae0b42efc19a0c7d56
Instruction ID: b46d8ffbe5f5d5b51bdd15562164278458cc08353932c754805ac2f44cd519fa
Opcode Fuzzy Hash: 70873c22a785b7e3d114070329d23f6d0f946579c7b0f2ae0b42efc19a0c7d56
Instruction Fuzzy Hash: 1FF0CD31442A12EBDF525BA4EE8DAD67A25BF05742F805016F201508A1C779A476CFA4

Function 00705D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00705D30
GetWindowRect.USER32(?,?), ref: 00705D71
ScreenToClient.USER32(?,?), ref: 00705D99
GetClientRect.USER32(?,?), ref: 00705ED7
GetWindowRect.USER32(?,?), ref: 00705EF8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 4f841099a53d62f27b46a1fab0ad0a630358ddacefddfe639da062a615353893
Instruction ID: 37332d24f35a1f4e2d47efa506023122fe7f2abf2105d0290f7b8ccd4ef4918f
Opcode Fuzzy Hash: 4f841099a53d62f27b46a1fab0ad0a630358ddacefddfe639da062a615353893
Instruction Fuzzy Hash: 0BB16B34A0064ADBDB10CFA9C4807EEB7F1FF58310F14851AE8A9D7290DB38AA51DF54

Function 007301B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 007300BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007300D6
__allrem.LIBCMT ref: 007300ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0073010B
__allrem.LIBCMT ref: 00730122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00730140

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: bc37ed5ac64abc873799aa5e7834fe34111d83f61bb2db554f5433dce257f6c4
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 9F810676A0071AEBF724AE28DC55B6F73F8AF41724F24413AF551D6682E778D9008790

Function 00781D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00783149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,0078101C,00000000,?,?,00000000), ref: 00783195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00781DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00781DE1
WSAGetLastError.WSOCK32 ref: 00781DF2
inet_ntoa.WSOCK32(?), ref: 00781E8C
htons.WSOCK32(?,?,?,?,?), ref: 00781EDB
_strlen.LIBCMT ref: 00781F35

Part of subcall function 007639E8: _strlen.LIBCMT ref: 007639F2

Part of subcall function 00706D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,0071CF58,?,?,?), ref: 00706DBA
Part of subcall function 00706D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,0071CF58,?,?,?), ref: 00706DED

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 61b67b3ec6f4bcf89fd42f79531be83e0d2dae2f939f7e878639c97776711910
Instruction ID: cad20cd5d06e07fcae7e9e1187753afc0d3598c1d997fcfe846eb6256d384249
Opcode Fuzzy Hash: 61b67b3ec6f4bcf89fd42f79531be83e0d2dae2f939f7e878639c97776711910
Instruction Fuzzy Hash: DAA1C231244340EFC314EF24C899E2A77E9AF84318F948A4CF5565B2E2DB79ED46CB91

Function 007361FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,007282D9,007282D9,?,?,?,0073644F,00000001,00000001,8BE85006), ref: 00736258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0073644F,00000001,00000001,8BE85006,?,?,?), ref: 007362DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 007363D8
__freea.LIBCMT ref: 007363E5

Part of subcall function 00733820: RtlAllocateHeap.NTDLL(00000000,?,007D1444,?,0071FDF5,?,?,0070A976,00000010,007D1440,007013FC,?,007013C6,?,00701129), ref: 00733852

__freea.LIBCMT ref: 007363EE
__freea.LIBCMT ref: 00736413

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 90b84c0a9d980d9d241e895d4ca23acb296a52b3b6842c400f5e3f8fb42a724f
Instruction ID: d9c8d0e5bf1051d087a67660d5a8bdae5570f6c3b319a5135b9124d3c1324dd0
Opcode Fuzzy Hash: 90b84c0a9d980d9d241e895d4ca23acb296a52b3b6842c400f5e3f8fb42a724f
Instruction Fuzzy Hash: F651B172A00216BBFB258F64DC85EBF77A9EB44750F158629FD05D6142EB3CDC50C6A0

Function 0078BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

Part of subcall function 0078C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0078B6AE,?,?), ref: 0078C9B5
Part of subcall function 0078C998: _wcslen.LIBCMT ref: 0078C9F1
Part of subcall function 0078C998: _wcslen.LIBCMT ref: 0078CA68
Part of subcall function 0078C998: _wcslen.LIBCMT ref: 0078CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0078BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0078BD25
RegCloseKey.ADVAPI32(00000000), ref: 0078BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0078BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0078BDF3
RegCloseKey.ADVAPI32(?), ref: 0078BDFF

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: ab61ee77bf7c1aa93fb7e4f99420eb2c70a02edfc679e467f664f44a505a3ce3
Instruction ID: 6d18fa8932a413a3be7c7e7d94228a518c1b610c877ba96e9c62181508782ecc
Opcode Fuzzy Hash: ab61ee77bf7c1aa93fb7e4f99420eb2c70a02edfc679e467f664f44a505a3ce3
Instruction Fuzzy Hash: 5281B230208241EFD714EF24C895E6ABBE5FF84308F14855DF5598B2A2DB39ED45CBA2

Function 0075F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0075F7B9
SysAllocString.OLEAUT32(00000001), ref: 0075F860
VariantCopy.OLEAUT32(0075FA64,00000000), ref: 0075F889
VariantClear.OLEAUT32(0075FA64), ref: 0075F8AD
VariantCopy.OLEAUT32(0075FA64,00000000), ref: 0075F8B1
VariantClear.OLEAUT32(?), ref: 0075F8BB

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 248795825c27b047d6d2fe3c8d27982c69c2146670b1cecc973e1442468f33a5
Instruction ID: 5565539649abc9bf2d22ad0ebf0d18e5d4d20376a0cbb10e26fa8dac9c3d50f1
Opcode Fuzzy Hash: 248795825c27b047d6d2fe3c8d27982c69c2146670b1cecc973e1442468f33a5
Instruction Fuzzy Hash: CE51E831601310FACF10AB65D899BA9B3E8EF45312F248467ED45DF2D1DBB8AC84C796

Function 0077910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00707620: _wcslen.LIBCMT ref: 00707625

Part of subcall function 00706B57: _wcslen.LIBCMT ref: 00706B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 007794E5
_wcslen.LIBCMT ref: 00779506
_wcslen.LIBCMT ref: 0077952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00779585

Strings

X, xrefs: 00779412

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 22a36b17862c567438047dec2b25163e5ec2ac6d1d97d8525915814602c9eec5
Instruction ID: d974e8d1780ec404b7920d6d96468ae27e48f6dff18a3ba945ecc4807c86ab68
Opcode Fuzzy Hash: 22a36b17862c567438047dec2b25163e5ec2ac6d1d97d8525915814602c9eec5
Instruction Fuzzy Hash: DAE1C431604350DFDB24DF24C885A6AB7E0BF85354F048A6DF9899B2E2DB38DD05CB92

Function 0071920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00719BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00719BB2

BeginPaint.USER32(?,?,?), ref: 00719241
GetWindowRect.USER32(?,?), ref: 007192A5
ScreenToClient.USER32(?,?), ref: 007192C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 007192D3
EndPaint.USER32(?,?,?,?,?), ref: 00719321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 007571EA

Part of subcall function 00719339: BeginPath.GDI32(00000000), ref: 00719357

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 4d84b3d2424dd0e1a8f5cb0bbf734697505f38fae1cd51f47c924cfdb2110b6e
Instruction ID: 56df12ed9ca4c82dd0d65376ca06ceda6a834c079c1fd467784d0a523645438b
Opcode Fuzzy Hash: 4d84b3d2424dd0e1a8f5cb0bbf734697505f38fae1cd51f47c924cfdb2110b6e
Instruction Fuzzy Hash: 2641B370105240EFD711DF58DCA4FF67BB8EB45321F14422AFAA4871E1C7789886DB65

Function 007707EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0077080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00770847
EnterCriticalSection.KERNEL32(?), ref: 00770863
LeaveCriticalSection.KERNEL32(?), ref: 007708DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 007708F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00770921

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 4734cfccd2c3b5671e7762d356ab554852a23109fbcd7d75c0009e65262fa367
Instruction ID: bb4bdd6a8a173c97b234023063f12c580b4aef09ad7ede118cfdea3672f8fc90
Opcode Fuzzy Hash: 4734cfccd2c3b5671e7762d356ab554852a23109fbcd7d75c0009e65262fa367
Instruction Fuzzy Hash: 1B415C71A00205EFDF15EF54DC85AAA77B8FF04310F1480A9ED049A297D738EE65DBA4

Function 007981DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0075F3AB,00000000,?,?,00000000,?,0075682C,00000004,00000000,00000000), ref: 0079824C
EnableWindow.USER32(?,00000000), ref: 00798272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 007982D1
ShowWindow.USER32(?,00000004), ref: 007982E5
EnableWindow.USER32(?,00000001), ref: 0079830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0079832F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 89d1396c738004f2dd45a62f3f7ca55878cd1836bbb76e5f52ce8fba50bc6805
Instruction ID: 407f7fea6b35387b86a355555ce0b670fb6ba5e37e71631ef82267d6e3b88e55
Opcode Fuzzy Hash: 89d1396c738004f2dd45a62f3f7ca55878cd1836bbb76e5f52ce8fba50bc6805
Instruction Fuzzy Hash: 65419434601644AFDF51CF15E899BE87BF0FB0B714F5881AAE5084B262CB39A841CB56

Function 00764C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00764C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00764CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00764CEA
_wcslen.LIBCMT ref: 00764D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00764D10
_wcsstr.LIBVCRUNTIME ref: 00764D1A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: ad05da49d081add106105ac76d8471b645ee94a26babe0465da4081dccf55dda
Instruction ID: 97454028e098968245f55b230efc7516e7fd3b821eb3ba67cc52241c2cee1987
Opcode Fuzzy Hash: ad05da49d081add106105ac76d8471b645ee94a26babe0465da4081dccf55dda
Instruction Fuzzy Hash: 2121F332704210BBEB265B39EC49E7B7BACDF45750F10806AFD06CA192EB69DC4196A0

Function 0077581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00703AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00703A97,?,?,00702E7F,?,?,?,00000000), ref: 00703AC2

_wcslen.LIBCMT ref: 0077587B
CoInitialize.OLE32(00000000), ref: 00775995
CoCreateInstance.OLE32(0079FCF8,00000000,00000001,0079FB68,?), ref: 007759AE
CoUninitialize.OLE32 ref: 007759CC

Strings

.lnk, xrefs: 00775876, 007758C1, 00775985

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 19e46013ea3783cf3b05d0eba529d660b78f2b8c294cf735a7f135c8d2b73cb3
Instruction ID: 11c33e7273a53026254e740be4bb7da2dc650ad7e79da33a0d0630fff12abf46
Opcode Fuzzy Hash: 19e46013ea3783cf3b05d0eba529d660b78f2b8c294cf735a7f135c8d2b73cb3
Instruction Fuzzy Hash: CCD163B1A04701DFCB14DF24C484A2ABBE1EF89350F14895DF9899B3A1DB79EC45CB92

Function 0076175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00760FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00760FCA
Part of subcall function 00760FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00760FD6
Part of subcall function 00760FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00760FE5
Part of subcall function 00760FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00760FEC
Part of subcall function 00760FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00761002

GetLengthSid.ADVAPI32(?,00000000,00761335), ref: 007617AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 007617BA
HeapAlloc.KERNEL32(00000000), ref: 007617C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 007617DA
GetProcessHeap.KERNEL32(00000000,00000000,00761335), ref: 007617EE
HeapFree.KERNEL32(00000000), ref: 007617F5

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 2c20050508ca7b0c80630b283c96d51d1287d2a628941cb26a1a203749ff3a2b
Instruction ID: 5213d4793366b110f0b25e9372ea799a642beb10719dfe412cfa7b78f3822b2b
Opcode Fuzzy Hash: 2c20050508ca7b0c80630b283c96d51d1287d2a628941cb26a1a203749ff3a2b
Instruction Fuzzy Hash: 1411BE71500205FFDF119FA4CC49BAF7BA9EB41355F588019F94297210D739AE41CB64

Function 007614CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 007614FF
OpenProcessToken.ADVAPI32(00000000), ref: 00761506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00761515
CloseHandle.KERNEL32(00000004), ref: 00761520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0076154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00761563

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: d32a70bebcfc64bf3461ff22acc68f02ede3618ac6637f1a8fd8a4b5ce7b4415
Instruction ID: 7d59601543f1b1d99510cac231e939e9087775130abacad5c2d3f0704c9f3387
Opcode Fuzzy Hash: d32a70bebcfc64bf3461ff22acc68f02ede3618ac6637f1a8fd8a4b5ce7b4415
Instruction Fuzzy Hash: A3113D7250124DABDF128F98DE49FDE7BA9EF48744F088015FE06A2060C379CE61DB61

Function 00723382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00723379,00722FE5), ref: 00723390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0072339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 007233B7
SetLastError.KERNEL32(00000000,?,00723379,00722FE5), ref: 00723409

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3b70f3ee56c5bf43867ec64d1c9838f36528897c009a67d7f81b67d1a35b9590
Instruction ID: be46d0e75deed71e325f3e8d248f1fce419adb7b127fba33f0f5c54b3a735b41
Opcode Fuzzy Hash: 3b70f3ee56c5bf43867ec64d1c9838f36528897c009a67d7f81b67d1a35b9590
Instruction Fuzzy Hash: 8801F733609331FEAA2637747C89A672B98EB05779720422EF414952F2EF1D4E435558

Function 00732D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00735686,00743CD6,?,00000000,?,00735B6A,?,?,?,?,?,0072E6D1,?,007C8A48), ref: 00732D78
_free.LIBCMT ref: 00732DAB
_free.LIBCMT ref: 00732DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0072E6D1,?,007C8A48,00000010,00704F4A,?,?,00000000,00743CD6), ref: 00732DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0072E6D1,?,007C8A48,00000010,00704F4A,?,?,00000000,00743CD6), ref: 00732DEC
_abort.LIBCMT ref: 00732DF2

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: d6d7767a4fbb80ade0cf1319ef5a453be62e8b23c864b17eed9638483bc62f97
Instruction ID: 1b9755485af8650596ba34cc85440ed39ced5074ffb4dce5cff8a3a7354cc55f
Opcode Fuzzy Hash: d6d7767a4fbb80ade0cf1319ef5a453be62e8b23c864b17eed9638483bc62f97
Instruction Fuzzy Hash: C4F0C832715610BBF6232735BC0EF5B2659BFC27A1F244419F824922E3EE2C98035165

Function 00798A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00719639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00719693
Part of subcall function 00719639: SelectObject.GDI32(?,00000000), ref: 007196A2
Part of subcall function 00719639: BeginPath.GDI32(?), ref: 007196B9
Part of subcall function 00719639: SelectObject.GDI32(?,00000000), ref: 007196E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00798A4E
LineTo.GDI32(?,00000003,00000000), ref: 00798A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00798A70
LineTo.GDI32(?,00000000,00000003), ref: 00798A80
EndPath.GDI32(?), ref: 00798A90
StrokePath.GDI32(?), ref: 00798AA0

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: ae3ed36d7934cc163eb4260cc421cbec027101942e03232d7edf9d6447b3d875
Instruction ID: 29eb0e3057634865623936a96a0ae6194d9ede7b77436b838964737012db2e52
Opcode Fuzzy Hash: ae3ed36d7934cc163eb4260cc421cbec027101942e03232d7edf9d6447b3d875
Instruction Fuzzy Hash: 9F11097604014CFFDF129F94EC88EAA7F6DEB08350F00C012FA199A1A1C775AD56DBA4

Function 007651FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00765218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00765229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00765230
ReleaseDC.USER32(00000000,00000000), ref: 00765238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0076524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00765261

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: ba13d27a22dab09da9471b2897ee73c322d4bb1e817b3e08369e221b5e315fb5
Instruction ID: 255f6acba5fbaf3c5c922ff5e7a0503f12f3fe54337e194754428a26dddb3f00
Opcode Fuzzy Hash: ba13d27a22dab09da9471b2897ee73c322d4bb1e817b3e08369e221b5e315fb5
Instruction Fuzzy Hash: F0018FB5A00708BBEF119BA59C49A4EBFB8FB48351F048066FA05A7280D6749801CBA4

Function 00701BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00701BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00701BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00701C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00701C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00701C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00701C22

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 9301c990123db78179f95062be692d60ff009cee9cea926f34246c0f0649664e
Instruction ID: 0b6bea5549b196457eea7d0a2702b650a7444a64445dadfd7c2efb538c22d5a3
Opcode Fuzzy Hash: 9301c990123db78179f95062be692d60ff009cee9cea926f34246c0f0649664e
Instruction Fuzzy Hash: 280167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00415BA15C4BA42C7F5A864CBE5

Function 0076EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0076EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0076EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0076EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0076EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0076EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0076EB75

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 0f5cf283fb1914b39d29c2cc53030dc2f7aab5c86700b6802ad45b9843cee111
Instruction ID: 40295c9ec278f963dfeb74a33a8f884e5641ab3fb7ce65a8ebb8be3258b658cd
Opcode Fuzzy Hash: 0f5cf283fb1914b39d29c2cc53030dc2f7aab5c86700b6802ad45b9843cee111
Instruction Fuzzy Hash: A3F054B2140558BBEB2257529C0EEEF3E7CEFCAB11F00815AF601D1191D7A85A02C6BD

Function 00757439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00757452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00757469
GetWindowDC.USER32(?), ref: 00757475
GetPixel.GDI32(00000000,?,?), ref: 00757484
ReleaseDC.USER32(?,00000000), ref: 00757496
GetSysColor.USER32(00000005), ref: 007574B0

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 07d9feae5ee18715a86383b64ddae2b38a9b392bb4a762882c1bf61a515c7310
Instruction ID: cba0de6d39c14a81aef13f5ac336b4c2bcfbf66fca1a615e9843ecd1db40d3ac
Opcode Fuzzy Hash: 07d9feae5ee18715a86383b64ddae2b38a9b392bb4a762882c1bf61a515c7310
Instruction Fuzzy Hash: FC018B31400205EFDF125FA4EC08BEA7BB5FB04312F618061FD16A20A0CB391E52EB14

Function 00761874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0076187F
UnloadUserProfile.USERENV(?,?), ref: 0076188B
CloseHandle.KERNEL32(?), ref: 00761894
CloseHandle.KERNEL32(?), ref: 0076189C
GetProcessHeap.KERNEL32(00000000,?), ref: 007618A5
HeapFree.KERNEL32(00000000), ref: 007618AC

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 2e4bc78b6f149739e97d4387f7ba9f1379b43478f71a99704492785fdf2f4f07
Instruction ID: 0692fca6edbaf5f2ea2c52ba089938dd66798c3a63175f5ecc3a994bb0d49766
Opcode Fuzzy Hash: 2e4bc78b6f149739e97d4387f7ba9f1379b43478f71a99704492785fdf2f4f07
Instruction Fuzzy Hash: 66E0E576044905BBDF025FA1EE0D90ABF39FF49B22B10C222F22581170CB369822DF69

Function 0070BBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0070BEB3

Strings

D%}, xrefs: 0070BDED, 0070BD91, 0070BD1B
D%}, xrefs: 0070BE9A
D%}D%}, xrefs: 0070BCA5
D%}, xrefs: 0070BCA2

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%}$D%}$D%}$D%}D%}
API String ID: 1385522511-1153134958
Opcode ID: d308375ec324788d5974918b83c4de1ae3e6169980bb15091b65a13fcca90a61
Instruction ID: 9a312cd0bea1436955fa6bc28194ba46ed948c3373ad3b2f5638721379daf9d8
Opcode Fuzzy Hash: d308375ec324788d5974918b83c4de1ae3e6169980bb15091b65a13fcca90a61
Instruction Fuzzy Hash: 20913075A00205DFCB14CF58C090AAAB7F1FF58314F24866ED545A7391E739EE92CBA0

Function 00787B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00720242: EnterCriticalSection.KERNEL32(007D070C,007D1884,?,?,0071198B,007D2518,?,?,?,007012F9,00000000), ref: 0072024D
Part of subcall function 00720242: LeaveCriticalSection.KERNEL32(007D070C,?,0071198B,007D2518,?,?,?,007012F9,00000000), ref: 0072028A

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

Part of subcall function 007200A3: __onexit.LIBCMT ref: 007200A9

__Init_thread_footer.LIBCMT ref: 00787BFB

Part of subcall function 007201F8: EnterCriticalSection.KERNEL32(007D070C,?,?,00718747,007D2514), ref: 00720202
Part of subcall function 007201F8: LeaveCriticalSection.KERNEL32(007D070C,?,00718747,007D2514), ref: 00720235

Strings

+Tu, xrefs: 00787E2E
Variable must be of type 'Object'., xrefs: 00787C3A
G, xrefs: 00787C7F
5, xrefs: 00787C78

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +Tu$5$G$Variable must be of type 'Object'.
API String ID: 535116098-335167736
Opcode ID: 95b4bf03c073869cbeddb2efb05ec4577eccdb12d433e9b27eb9101931ec4434
Instruction ID: 9b2cbe70e27cdab42dfe82c8e4aed52e060b57e192105b53d4dd0caa576cab47
Opcode Fuzzy Hash: 95b4bf03c073869cbeddb2efb05ec4577eccdb12d433e9b27eb9101931ec4434
Instruction Fuzzy Hash: A3918C70A44209EFCB18EF54D895DADB7B6FF44300F248059F806AB292DB79EE41DB61

Function 0076C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00707620: _wcslen.LIBCMT ref: 00707625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0076C6EE
_wcslen.LIBCMT ref: 0076C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0076C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0076C7CA

Strings

0, xrefs: 0076C6AF

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: b02f447fddc6d15579c76fa79b0ebe754f73ac3b6d0747f6bf50e0870d109543
Instruction ID: 59c685cf19b8ed2f30227f3e378eced7c909f096f313aac80d64473f7bd6e8c6
Opcode Fuzzy Hash: b02f447fddc6d15579c76fa79b0ebe754f73ac3b6d0747f6bf50e0870d109543
Instruction Fuzzy Hash: C151DF71604301ABD7129F28C889A7B77E8AF49310F040A2EFDD6D31D1DB6CE8049B56

Function 0078AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0078AEA3

Part of subcall function 00707620: _wcslen.LIBCMT ref: 00707625

GetProcessId.KERNEL32(00000000), ref: 0078AF38
CloseHandle.KERNEL32(00000000), ref: 0078AF67

Strings

<, xrefs: 0078AE6B
@, xrefs: 0078AE72

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 9b179e6290dfd5f412d7f51b268372134e9011888cce0767d9a9b7c2e0c28831
Instruction ID: 5afe0dd66e83025001399675d725c297426ea8fa21088735584c7f18829085bf
Opcode Fuzzy Hash: 9b179e6290dfd5f412d7f51b268372134e9011888cce0767d9a9b7c2e0c28831
Instruction Fuzzy Hash: 54717C71A00615EFDB14EF54C489A9EBBF0FF08314F04859AE816AB392CB78ED45CB91

Function 0076719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00767206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0076723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0076724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 007672CF

Strings

DllGetClassObject, xrefs: 00767242

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: e0867ab4ead4522b4b1385ed5fdd7b34441f7a40902cca7d80c2e3d6f9b798d5
Instruction ID: f399c186d8defa7456c82c5b9533c5a8d9e609e0afac075019d2bc69c8a6f100
Opcode Fuzzy Hash: e0867ab4ead4522b4b1385ed5fdd7b34441f7a40902cca7d80c2e3d6f9b798d5
Instruction Fuzzy Hash: 304171B1604204DFDB19CF54C894A9A7BB9FF44358F1480ADFD069F20AD7B8D945DBA0

Function 00793D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00793E35
IsMenu.USER32(?), ref: 00793E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00793E92
DrawMenuBar.USER32 ref: 00793EA5

Strings

0, xrefs: 00793D89

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 6a67a10f9aaae9b719fce7f1a5e0950ad19d615b9b07ab07cd482a0d1a751109
Instruction ID: 061278b8dc842480a3c901c7af5b68910cef03920d7d0ea621b1180ea54579c8
Opcode Fuzzy Hash: 6a67a10f9aaae9b719fce7f1a5e0950ad19d615b9b07ab07cd482a0d1a751109
Instruction Fuzzy Hash: 30414775A01209EFDF10DF60E884AAABBB9FF49354F04812AE915A7250D738AE55CF60

Function 00761DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

Part of subcall function 00763CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00763CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00761E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00761E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00761EA9

Part of subcall function 00706B57: _wcslen.LIBCMT ref: 00706B6A

Strings

ComboBox, xrefs: 00761DF0
ListBox, xrefs: 00761E25

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: f33e15e55be59d474ee8a408e75761b6fed60138e4cfc58f688fbbe9be48174c
Instruction ID: abea76c89e8d4cd09b1b22d12dc9b177e65f2474254a98cdbfd4ffdc59a3c273
Opcode Fuzzy Hash: f33e15e55be59d474ee8a408e75761b6fed60138e4cfc58f688fbbe9be48174c
Instruction Fuzzy Hash: B221F3B1A00104EADB14AB64DC4DCFFBBB8DF45350B588119FD26A71E1DB3D8D0A9630

Function 00792F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00792F8D
LoadLibraryW.KERNEL32(?), ref: 00792F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00792FA9
DestroyWindow.USER32(?), ref: 00792FB1

Strings

SysAnimate32, xrefs: 00792F68

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 07ea52542ecd16366e8b693245a0d7a1583ac76e9adb867aedea80171f7f9c41
Instruction ID: e45bcefe53b0b93e1a24a4ff56c02263f2d02853de0732165bfc7a3d70a69b33
Opcode Fuzzy Hash: 07ea52542ecd16366e8b693245a0d7a1583ac76e9adb867aedea80171f7f9c41
Instruction Fuzzy Hash: 2021DC72200205BBEF11AF64EC84EBB37BAEB59364F104619FA10D20A1C739DC529760

Function 00724D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00724D1E,007328E9,?,00724CBE,007328E9,007C88B8,0000000C,00724E15,007328E9,00000002), ref: 00724D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00724DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00724D1E,007328E9,?,00724CBE,007328E9,007C88B8,0000000C,00724E15,007328E9,00000002,00000000), ref: 00724DC3

Strings

mscoree.dll, xrefs: 00724D86
CorExitProcess, xrefs: 00724D98

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1f715678d3a695519a48a5b1fa1e816c33a3cac547a9238715aea70777c166e8
Instruction ID: 4714ab172d48202ce9e7916c5f8894fdef7fcdd5b8a92c7233ede26fc21afe29
Opcode Fuzzy Hash: 1f715678d3a695519a48a5b1fa1e816c33a3cac547a9238715aea70777c166e8
Instruction Fuzzy Hash: 56F0C230A40218FBDF129F90EC09BADBFB5EF44711F0041A9F909A2260CB385D41CBD8

Function 0075D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0075D3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0075D3BF
FreeLibrary.KERNEL32(00000000), ref: 0075D3E5

Strings

X64, xrefs: 0075D2A8
GetSystemWow64DirectoryW, xrefs: 0075D3B9

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 8fb525ce18f5eeffcb2682a3d02870af5f5510c9ecc66e88f9a92a46ea4fbc0d
Instruction ID: de8912ead2b987508069be131d05be4e6d50c6533e9e31042ea03fe2b3f30d32
Opcode Fuzzy Hash: 8fb525ce18f5eeffcb2682a3d02870af5f5510c9ecc66e88f9a92a46ea4fbc0d
Instruction Fuzzy Hash: 6CF0E5B1546A21DBDB3267109C589E97325BF10703F94816AFC06E2154DBECCD8CCA9B

Function 00704E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00704EDD,?,007D1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00704E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00704EAE
FreeLibrary.KERNEL32(00000000,?,?,00704EDD,?,007D1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00704EC0

Strings

kernel32.dll, xrefs: 00704E94
Wow64DisableWow64FsRedirection, xrefs: 00704EA8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 618acca74e8412adc6cd57be64a554fe5bdb26cada00321f248fccaac7ba94e5
Instruction ID: 90aa4b75424f817659626158c9a9da03629ae0b755cab093622809a9f8ad93a6
Opcode Fuzzy Hash: 618acca74e8412adc6cd57be64a554fe5bdb26cada00321f248fccaac7ba94e5
Instruction Fuzzy Hash: A1E0CDF5A415229BD6331725FC18B5F7694AF81F627054216FD04D3150DB6CCD0340EC

Function 00704E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00743CDE,?,007D1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00704E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00704E74
FreeLibrary.KERNEL32(00000000,?,?,00743CDE,?,007D1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00704E87

Strings

kernel32.dll, xrefs: 00704E5B
Wow64RevertWow64FsRedirection, xrefs: 00704E6E

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 07e5e1846551f768b259f5e91e55f756d7661e31200a68f09cb77e2f932ab04e
Instruction ID: 811d7078318274e1d50dce03e914b3caa78dc1b69375c96fd1e8291ba2380e32
Opcode Fuzzy Hash: 07e5e1846551f768b259f5e91e55f756d7661e31200a68f09cb77e2f932ab04e
Instruction Fuzzy Hash: 58D0C2B154262197CE231B24BC08E8B2A58AF81B11305825ABA08A2190CF2CCD0281D8

Function 00772947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00772C05
DeleteFileW.KERNEL32(?), ref: 00772C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00772C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00772CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00772CC0

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 585d6c63d15b87af307903931a1c1267c3233ec2c47a830696b2d99a2064ccff
Instruction ID: f1d306269b4d32e498a3bf23df74bf377dad9d639fd6aa249857b291b213e278
Opcode Fuzzy Hash: 585d6c63d15b87af307903931a1c1267c3233ec2c47a830696b2d99a2064ccff
Instruction Fuzzy Hash: D3B171B1D00129EBDF21DFA4CC89EDE77BDEF49340F1080A6F519E6152EA389A458F61

Function 0078A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0078A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0078A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0078A468
CloseHandle.KERNEL32(?), ref: 0078A63D

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: c5f08772b39a9a03649a4166f7bfe5bd4e31a038b7cb7bad9eaa1bdcfae7ca56
Instruction ID: f8fad2e1d4e6980dd9bd6bd259257e0959049822c439ae14bdf3004d80d20827
Opcode Fuzzy Hash: c5f08772b39a9a03649a4166f7bfe5bd4e31a038b7cb7bad9eaa1bdcfae7ca56
Instruction Fuzzy Hash: 60A1B371644301EFE720EF18C886F2AB7E1AF44714F14895DF9599B2D2DBB4EC418B92

Function 0076E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0076DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0076CF22,?), ref: 0076DDFD

Part of subcall function 0076DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0076CF22,?), ref: 0076DE16

Part of subcall function 0076E199: GetFileAttributesW.KERNEL32(?,0076CF95), ref: 0076E19A

lstrcmpiW.KERNEL32(?,?), ref: 0076E473
MoveFileW.KERNEL32(?,?), ref: 0076E4AC
_wcslen.LIBCMT ref: 0076E5EB
_wcslen.LIBCMT ref: 0076E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0076E650

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: a714a2c2da3f8ce65dedd3b61ca3fda0d217f34d985d569281fc90b929622cd9
Instruction ID: ecc91e904acd14da7229513a3ccd936331f68caf4d283c373e0fbe6a6ffd035c
Opcode Fuzzy Hash: a714a2c2da3f8ce65dedd3b61ca3fda0d217f34d985d569281fc90b929622cd9
Instruction Fuzzy Hash: BC5166B2508385DBC724DBA0DC859DF77DCAF85340F00491EFA8AD3191EF78A5888766

Function 0078B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

Part of subcall function 0078C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0078B6AE,?,?), ref: 0078C9B5
Part of subcall function 0078C998: _wcslen.LIBCMT ref: 0078C9F1
Part of subcall function 0078C998: _wcslen.LIBCMT ref: 0078CA68
Part of subcall function 0078C998: _wcslen.LIBCMT ref: 0078CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0078BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0078BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0078BB63
RegCloseKey.ADVAPI32(?,?), ref: 0078BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0078BBB3

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 28941b8f2befef32039ea5bb8332533311a82552d9e5687f1d513d45bd270ef2
Instruction ID: 10990ec220ca620360a3ca1a12d77c24da06dca8fb1a175a5aec020b3a9d6d6e
Opcode Fuzzy Hash: 28941b8f2befef32039ea5bb8332533311a82552d9e5687f1d513d45bd270ef2
Instruction Fuzzy Hash: 7361B571208241EFD714EF24C894E2ABBE5FF84308F54855DF4998B2A2DB39ED45CB92

Function 00768BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00768BCD
VariantClear.OLEAUT32 ref: 00768C3E
VariantClear.OLEAUT32 ref: 00768C9D
VariantClear.OLEAUT32(?), ref: 00768D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00768D3B

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 10c4aa30926a1f1bca7302fedee1914ecb7e8887c67ca77489d4f2ec030a943e
Instruction ID: fac5c2c8466684a860d424a890208650cad2e5d0e5774b5b979c110e07354f56
Opcode Fuzzy Hash: 10c4aa30926a1f1bca7302fedee1914ecb7e8887c67ca77489d4f2ec030a943e
Instruction Fuzzy Hash: 35515BB5A00619EFCB14CF68C894AAABBF4FF8D310B158559ED16DB350E734E911CBA0

Function 00778AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00778BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00778BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00778C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00778C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00778C5F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: fd217a98136710fb28918bb62e067c5de3ac913e6207c0197aed1d404006744f
Instruction ID: 0ca512a6b5754af908934a7ef01f13fe9aaa370e07ea5dd7b97fad5e3acbcca5
Opcode Fuzzy Hash: fd217a98136710fb28918bb62e067c5de3ac913e6207c0197aed1d404006744f
Instruction Fuzzy Hash: 75513D75A00215DFCB05DF54C885AA9BBF5FF48314F08C499E8496B3A2CB39ED51CB91

Function 00788EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00788F40
GetProcAddress.KERNEL32(00000000,?), ref: 00788FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00788FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00789032
FreeLibrary.KERNEL32(00000000), ref: 00789052

Part of subcall function 0071F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00771043,?,753CE610), ref: 0071F6E6
Part of subcall function 0071F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0075FA64,00000000,00000000,?,?,00771043,?,753CE610,?,0075FA64), ref: 0071F70D

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: fcdef22c87b36ef7d674861c64c863298e1efcfade26d44f3317abab7473e1f7
Instruction ID: 6139136ca3023f9d7e806d8968d8df57ca22782c2140f9e927b50d89bc061c17
Opcode Fuzzy Hash: fcdef22c87b36ef7d674861c64c863298e1efcfade26d44f3317abab7473e1f7
Instruction Fuzzy Hash: 2C514F34640205DFCB15EF54C4848ADBBF1FF49314F488199E906AB3A2DB35ED85CB91

Function 00796B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00796C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00796C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00796C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0077AB79,00000000,00000000), ref: 00796C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00796CC7

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 742344f3f9491bf2297a6d15da8802fcfd03ba7cf343d2f364f1670bc96209d5
Instruction ID: 386ac456419f550083c8f96c188c07b722946528268a34c4a79d107658b95568
Opcode Fuzzy Hash: 742344f3f9491bf2297a6d15da8802fcfd03ba7cf343d2f364f1670bc96209d5
Instruction Fuzzy Hash: 4D410235A00104AFDF25DF28DC58FA97BA5EB0A350F154369F899A72E0D379FD41CA60

Function 00732051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007320C3
_free.LIBCMT ref: 007320E3

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 0b7ad391a4df5700f78102daf36d38b50a449235a60f21527d2679f9e34d4b9c
Instruction ID: ee61e565445b6ce8f33f9b46c9b7991c1f7aca6de9e4fada49d25c48b08dd36d
Opcode Fuzzy Hash: 0b7ad391a4df5700f78102daf36d38b50a449235a60f21527d2679f9e34d4b9c
Instruction Fuzzy Hash: A441E232A00214EFDB24DF78C984A5EB3B5EF88710F1545A8E515EB393EA35AD02CB80

Function 0071912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00719141
ScreenToClient.USER32(00000000,?), ref: 0071915E
GetAsyncKeyState.USER32(00000001), ref: 00719183
GetAsyncKeyState.USER32(00000002), ref: 0071919D

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 6bea71714354e5a85838bb350dbc0b04af2c5dd0bd179684f37fa7ba0f57e159
Instruction ID: 13037d6d5f78c8aab60e537b70a0dd6137457f0badf3cf6f9fde98bc9879239c
Opcode Fuzzy Hash: 6bea71714354e5a85838bb350dbc0b04af2c5dd0bd179684f37fa7ba0f57e159
Instruction Fuzzy Hash: 3641903190850AFBDF099F68D858BEEB774FB45320F208215E925A32D0C7786D95DB51

Function 00773874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 007738CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00773922
TranslateMessage.USER32(?), ref: 0077394B
DispatchMessageW.USER32(?), ref: 00773955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00773966

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: f3b86bc1ff9e4f186e4078c288fc32a4153040c051dc35d856db0d1f7b9903d5
Instruction ID: a1f7229ab3397f84c5af050531f318084c801bfa558bd877ac24d9756aad5649
Opcode Fuzzy Hash: f3b86bc1ff9e4f186e4078c288fc32a4153040c051dc35d856db0d1f7b9903d5
Instruction Fuzzy Hash: 0531C870505341AEEF25CB749848BB637B4AB05388F44C56AD56A82190D3BCB685EF25

Function 0077CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0077CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0077CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0077C21E,00000000), ref: 0077CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0077C21E,00000000), ref: 0077CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0077C21E,00000000), ref: 0077CFF2

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 98fd368510506adcfab2537978a6504a726c19c9316af6fcd464b141522de61c
Instruction ID: 75b1abe5a69bf2587a15bfc7b923acd7882b3dcc692cf74227f5dd50c41f0035
Opcode Fuzzy Hash: 98fd368510506adcfab2537978a6504a726c19c9316af6fcd464b141522de61c
Instruction Fuzzy Hash: F1315072600605EFDF21DFA5D8849ABBBF9EF18390B10842EF50AD2141D738AE41DB60

Function 00761901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00761915
PostMessageW.USER32(00000001,00000201,00000001), ref: 007619C1
Sleep.KERNEL32(00000000,?,?,?), ref: 007619C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 007619DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 007619E2

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: bd84d1b9125daa27d84241b33a4ed7abafcd7cba5a5930f97f56931b58cb05c3
Instruction ID: 5279f8906151d7d9ad0e534f90edd0595dff31f2d542e0e288ae89edd62558ec
Opcode Fuzzy Hash: bd84d1b9125daa27d84241b33a4ed7abafcd7cba5a5930f97f56931b58cb05c3
Instruction Fuzzy Hash: 6731AD71A00259EFCB00CFA8C99DADE3BB5EB04315F548269FD22A72D1C774AD44CB90

Function 00795706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00795745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0079579D
_wcslen.LIBCMT ref: 007957AF
_wcslen.LIBCMT ref: 007957BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00795816

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 6c2c09e6c0a549a87120d67ceda06302ba1d619d1f69f619d96b848b7d923771
Instruction ID: add33c7ea94da819aeeecdf907d179e4338128d1d194a7864bad4d8a9ed9a634
Opcode Fuzzy Hash: 6c2c09e6c0a549a87120d67ceda06302ba1d619d1f69f619d96b848b7d923771
Instruction Fuzzy Hash: 2B21A771904628EADF21CFA0EC44EED7778FF04720F108156E929DA191D7789A85CF50

Function 00780930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00780951
GetForegroundWindow.USER32 ref: 00780968
GetDC.USER32(00000000), ref: 007809A4
GetPixel.GDI32(00000000,?,00000003), ref: 007809B0
ReleaseDC.USER32(00000000,00000003), ref: 007809E8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: b6e7d64d8528004d6d818d9ee810b456108f207aebacf566bf9acea490aaac26
Instruction ID: f2e4edb95af20e7f85891a9c3f94ae7b52f556ca58356704dcc23a3eb4a1a558
Opcode Fuzzy Hash: b6e7d64d8528004d6d818d9ee810b456108f207aebacf566bf9acea490aaac26
Instruction Fuzzy Hash: 6921A435600204EFDB14EF68C848A6EB7E5EF48740F04C169F84A97352DB78AC04CB90

Function 0073CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0073CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0073CDE9

Part of subcall function 00733820: RtlAllocateHeap.NTDLL(00000000,?,007D1444,?,0071FDF5,?,?,0070A976,00000010,007D1440,007013FC,?,007013C6,?,00701129), ref: 00733852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0073CE0F
_free.LIBCMT ref: 0073CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0073CE31

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 0c79aa988cd2e32ef1d70c7fc41ca1951bf4107d38fb8c91ab823a3e48dce3c7
Instruction ID: 41105f155676e901e45b90a7001d598dd8633087503a742d50a5472cbd714c34
Opcode Fuzzy Hash: 0c79aa988cd2e32ef1d70c7fc41ca1951bf4107d38fb8c91ab823a3e48dce3c7
Instruction Fuzzy Hash: D90147726412187F372326B66C8CC7B796CDEC2BA0B14412EFD00E3203EA2D8D0283B4

Function 00719639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00719693
SelectObject.GDI32(?,00000000), ref: 007196A2
BeginPath.GDI32(?), ref: 007196B9
SelectObject.GDI32(?,00000000), ref: 007196E2

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 53a52104ba5152592aefadacdcdde5e6133aa6e9d6caf65e514a15a4fcb58e4e
Instruction ID: 94282ae09931a7b78768852e37ffd2cbcd489fcf31074e99a3accc38a428c884
Opcode Fuzzy Hash: 53a52104ba5152592aefadacdcdde5e6133aa6e9d6caf65e514a15a4fcb58e4e
Instruction Fuzzy Hash: 5E217170802345FBDB119F68EC247E93B74BB00355F508217F550A61F1D37C6896CBA8

Function 00765711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00765726
_memcmp.LIBVCRUNTIME ref: 00765744
_memcmp.LIBVCRUNTIME ref: 00765757
_memcmp.LIBVCRUNTIME ref: 0076576F
_memcmp.LIBVCRUNTIME ref: 00765787

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 880777db47845f187e0667c44965e227bac0823fede5291838a2dd94b4a199ae
Instruction ID: 6fc6a374786a4fb0526a81a6145455ec444ca43f382f292fda0fcd4001681ed5
Opcode Fuzzy Hash: 880777db47845f187e0667c44965e227bac0823fede5291838a2dd94b4a199ae
Instruction Fuzzy Hash: 5B01B9A1641615FBD6089520ED42FBB735DAB313A4F404020FD06AA641F76DEE20A2F0

Function 00732DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0072F2DE,00733863,007D1444,?,0071FDF5,?,?,0070A976,00000010,007D1440,007013FC,?,007013C6), ref: 00732DFD
_free.LIBCMT ref: 00732E32
_free.LIBCMT ref: 00732E59
SetLastError.KERNEL32(00000000,00701129), ref: 00732E66
SetLastError.KERNEL32(00000000,00701129), ref: 00732E6F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 0238fd9d2b5b45ad2a9cdcaca0960e8c3f835eaf3340e906f28c7d8766590a28
Instruction ID: 3e12cde1ddf6635fcc520cd89c55feeac8a7cf6f2adcf7ef6aa4170ee97c99f0
Opcode Fuzzy Hash: 0238fd9d2b5b45ad2a9cdcaca0960e8c3f835eaf3340e906f28c7d8766590a28
Instruction Fuzzy Hash: 8C012872285600ABFA1327757C4FE2B266DABC17B1F258029F425A22E3EF7C8C035065

Function 0076000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0075FF41,80070057,?,?,?,0076035E), ref: 0076002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0075FF41,80070057,?,?), ref: 00760046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0075FF41,80070057,?,?), ref: 00760054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0075FF41,80070057,?), ref: 00760064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0075FF41,80070057,?,?), ref: 00760070

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: f8d967573dbd411d6f2460bf3feb08289718ace8e3e87478a0f0bd7602a2b5cb
Instruction ID: bcb9213488dffaeb946ec3f57ec8785896d1c3ce6e7323cd55144906ea090423
Opcode Fuzzy Hash: f8d967573dbd411d6f2460bf3feb08289718ace8e3e87478a0f0bd7602a2b5cb
Instruction Fuzzy Hash: 2B018B76600204BFDF124F68DC08FAB7AADEB447A2F148125FD06E6210E7B9DD419BA0

Function 007610F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00761114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00760B9B,?,?,?), ref: 00761120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00760B9B,?,?,?), ref: 0076112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00760B9B,?,?,?), ref: 00761136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0076114D

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 851cd19fea3fef4779da23a435afc2c0e0391966b93525844863d52fbaff84cb
Instruction ID: 26c73b8724a671c7e43464384a0efd8558a5d8aa0008ce0d119aefb44f8a4b15
Opcode Fuzzy Hash: 851cd19fea3fef4779da23a435afc2c0e0391966b93525844863d52fbaff84cb
Instruction Fuzzy Hash: A4016DB5100209BFDF164FA8DC4DA6A3B6EEF86360B548416FA41C3360DA35DC018A64

Function 00760FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00760FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00760FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00760FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00760FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00761002

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 553df3824c214b909a5e443d6513bc0ff05d701074401ba4d6a0fef1620ea6f6
Instruction ID: c0adc4e1f8c7a0f4420694b4bed655de35296beb4520531c28351f7ce224c024
Opcode Fuzzy Hash: 553df3824c214b909a5e443d6513bc0ff05d701074401ba4d6a0fef1620ea6f6
Instruction Fuzzy Hash: 67F0AF75200305ABDF220FA49C4DF563B6DEF89762F508415F906C6260CA38DC418A74

Function 00761014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0076102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00761036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00761045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0076104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00761062

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: fb4b066347a8e166e3a46c7c89ee778b77a530657326a922d70fcf163223c187
Instruction ID: ad2cee25be848d33688eeb3057e964273cc1a8fee30390d096416b350b82f010
Opcode Fuzzy Hash: fb4b066347a8e166e3a46c7c89ee778b77a530657326a922d70fcf163223c187
Instruction Fuzzy Hash: B2F0A975200305ABDF221FA8EC4DF5A3BADEF89761F604416FA06D6260CA38DC418AB4

Function 0077030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0077017D,?,007732FC,?,00000001,00742592,?), ref: 00770324
CloseHandle.KERNEL32(?,?,?,?,0077017D,?,007732FC,?,00000001,00742592,?), ref: 00770331
CloseHandle.KERNEL32(?,?,?,?,0077017D,?,007732FC,?,00000001,00742592,?), ref: 0077033E
CloseHandle.KERNEL32(?,?,?,?,0077017D,?,007732FC,?,00000001,00742592,?), ref: 0077034B
CloseHandle.KERNEL32(?,?,?,?,0077017D,?,007732FC,?,00000001,00742592,?), ref: 00770358
CloseHandle.KERNEL32(?,?,?,?,0077017D,?,007732FC,?,00000001,00742592,?), ref: 00770365

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ebdbcfe4d45e3ef730c932cc4d436bdbc40e732c8c77cff889d0af54cdca52f7
Instruction ID: dfe2943836f4c49c9d06e1e13d91b4f8dcd448a820f078b4baf8d7ef3e852ade
Opcode Fuzzy Hash: ebdbcfe4d45e3ef730c932cc4d436bdbc40e732c8c77cff889d0af54cdca52f7
Instruction Fuzzy Hash: 2C019C72800B15DFCB30AF66D880812FBF9BE60255315CA3FD1AA52931C3B5A959CE80

Function 0073D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0073D752

Part of subcall function 007329C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0073D7D1,00000000,00000000,00000000,00000000,?,0073D7F8,00000000,00000007,00000000,?,0073DBF5,00000000), ref: 007329DE
Part of subcall function 007329C8: GetLastError.KERNEL32(00000000,?,0073D7D1,00000000,00000000,00000000,00000000,?,0073D7F8,00000000,00000007,00000000,?,0073DBF5,00000000,00000000), ref: 007329F0

_free.LIBCMT ref: 0073D764
_free.LIBCMT ref: 0073D776
_free.LIBCMT ref: 0073D788
_free.LIBCMT ref: 0073D79A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0f7c7b91eac1b67b488af50f17f74034a73cae5cca835e2db8b725a19bf61266
Instruction ID: 1155688938b24818c16f9d41b674860600b52d2229e26b0035fffabe2363cc30
Opcode Fuzzy Hash: 0f7c7b91eac1b67b488af50f17f74034a73cae5cca835e2db8b725a19bf61266
Instruction Fuzzy Hash: F6F01272544214ABA632EB64F9C6D1677DDBB44710F954849F088E7513C73CFC818A68

Function 00765C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00765C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00765C6F
MessageBeep.USER32(00000000), ref: 00765C87
KillTimer.USER32(?,0000040A), ref: 00765CA3
EndDialog.USER32(?,00000001), ref: 00765CBD

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 7598c577eefd8b96c9313260008dd360abb13d19d2fd5d67f67e15f6c1ea7134
Instruction ID: 65a0fdcf200f5befcfcb3ba78dc716bb6acaf75a7604794d8fff3c6f1a3870bf
Opcode Fuzzy Hash: 7598c577eefd8b96c9313260008dd360abb13d19d2fd5d67f67e15f6c1ea7134
Instruction Fuzzy Hash: 1501A470500B05AFEF215B10DD4EFA67BB8BF00B05F00565AB983A14E1DBF8A985DFA4

Function 007322A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007322BE

Part of subcall function 007329C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0073D7D1,00000000,00000000,00000000,00000000,?,0073D7F8,00000000,00000007,00000000,?,0073DBF5,00000000), ref: 007329DE
Part of subcall function 007329C8: GetLastError.KERNEL32(00000000,?,0073D7D1,00000000,00000000,00000000,00000000,?,0073D7F8,00000000,00000007,00000000,?,0073DBF5,00000000,00000000), ref: 007329F0

_free.LIBCMT ref: 007322D0
_free.LIBCMT ref: 007322E3
_free.LIBCMT ref: 007322F4
_free.LIBCMT ref: 00732305

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 661f96af4e5c3680bd714c86cae71c75b98891c3bf1cbd0f74da9ea614dadc6b
Instruction ID: df48eb3e4f6d6a5878b1cc99f8155f394a8c22140b9c80b32a8cb46bd22c7971
Opcode Fuzzy Hash: 661f96af4e5c3680bd714c86cae71c75b98891c3bf1cbd0f74da9ea614dadc6b
Instruction Fuzzy Hash: 9DF017749021209B9612AF54BC05A093BB4F718760F51954FF454E22B3C73D2813AEEC

Function 007195C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 007195D4
StrokeAndFillPath.GDI32(?,?,007571F7,00000000,?,?,?), ref: 007195F0
SelectObject.GDI32(?,00000000), ref: 00719603
DeleteObject.GDI32 ref: 00719616
StrokePath.GDI32(?), ref: 00719631

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 567492a8684b9e7c1cc928588a0ce04c68fe0aeb942fe05eabbd334f0a6a545a
Instruction ID: f2b7a26cccb8de5f3689981bff270d4ab6e72f28238e469197c8a381ed86f057
Opcode Fuzzy Hash: 567492a8684b9e7c1cc928588a0ce04c68fe0aeb942fe05eabbd334f0a6a545a
Instruction Fuzzy Hash: ABF03C30006248EBDB125F69ED2C7A43B71AB00322F44C216F565550F1D73CA9A3DF38

Function 00730F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 007310F9
__freea.LIBCMT ref: 00731117

Part of subcall function 00731537: _free.LIBCMT ref: 0073154F

Strings

a/p, xrefs: 007311DE
am/pm, xrefs: 0073117A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: fd1a56832aab67a228f0992fac19d62ba7c414536e44f09cc688d1192acc4345
Instruction ID: 2c9fc70d297eff884a9360342e52b0b6c21ea40e8ed4a34fa911c7999a116f2a
Opcode Fuzzy Hash: fd1a56832aab67a228f0992fac19d62ba7c414536e44f09cc688d1192acc4345
Instruction Fuzzy Hash: 17D12871A00206CAFB289F68C895BFEB7B1FF06300FA44159E541AB653D37D9D80CB91

Function 007861D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00720242: EnterCriticalSection.KERNEL32(007D070C,007D1884,?,?,0071198B,007D2518,?,?,?,007012F9,00000000), ref: 0072024D
Part of subcall function 00720242: LeaveCriticalSection.KERNEL32(007D070C,?,0071198B,007D2518,?,?,?,007012F9,00000000), ref: 0072028A

Part of subcall function 007200A3: __onexit.LIBCMT ref: 007200A9

__Init_thread_footer.LIBCMT ref: 00786238

Part of subcall function 007201F8: EnterCriticalSection.KERNEL32(007D070C,?,?,00718747,007D2514), ref: 00720202
Part of subcall function 007201F8: LeaveCriticalSection.KERNEL32(007D070C,?,00718747,007D2514), ref: 00720235

Part of subcall function 0077359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 007735E4
Part of subcall function 0077359C: LoadStringW.USER32(007D2390,?,00000FFF,?), ref: 0077360A

Strings

x#}, xrefs: 00786353
x#}, xrefs: 0078633A
x#}, xrefs: 0078636F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#}$x#}$x#}
API String ID: 1072379062-1301169260
Opcode ID: 33320cef50271be84465807a33d84e00f8fda502019d99c122fe0831e01bab77
Instruction ID: dab5a4c20da58be2e86f1dfb7033c057a768fcbe7ebee37b370dc7db1d345292
Opcode Fuzzy Hash: 33320cef50271be84465807a33d84e00f8fda502019d99c122fe0831e01bab77
Instruction Fuzzy Hash: 4AC17B71A40105EBDB14EF58C894EBEB7B9FF48310F108069FA45AB291DB78ED55CBA0

Function 00735AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JOp, xrefs: 00735BA8, 00735C6C

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID: JOp
API String ID: 0-2779313138
Opcode ID: c01034da7e18a900597d4c6c4ccc36e41318a562e9370f5e4ba2939686ae1ec3
Instruction ID: b85bfcaefd4026abe9a8cb730bafb1d34bf68964b3aae29133eb9515e03da63f
Opcode Fuzzy Hash: c01034da7e18a900597d4c6c4ccc36e41318a562e9370f5e4ba2939686ae1ec3
Instruction Fuzzy Hash: A951AFB1D0061AEFEB219FA4D849FEEBBB8AF06314F14015AF405A7293D73D99018B71

Function 00738A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00738B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00738B7A
__dosmaperr.LIBCMT ref: 00738B81

Strings

.r, xrefs: 00738A63

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .r
API String ID: 2434981716-397233886
Opcode ID: 1b211b90c26ee4d8fb117371172e26d45aefd3a7ac542dd3226104aac18483ec
Instruction ID: c313e61d10a250a0f4bd2ade40218e3f1216e87c8e1912833b5c6d1aadf8bd0d
Opcode Fuzzy Hash: 1b211b90c26ee4d8fb117371172e26d45aefd3a7ac542dd3226104aac18483ec
Instruction Fuzzy Hash: A2418EF0604256AFEB659F24C880A7DBFE5EB46300F2885AAF49487253DE3D8C029795

Function 00762716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0076B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007621D0,?,?,00000034,00000800,?,00000034), ref: 0076B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00762760

Part of subcall function 0076B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007621FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0076B3F8

Part of subcall function 0076B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0076B355
Part of subcall function 0076B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00762194,00000034,?,?,00001004,00000000,00000000), ref: 0076B365
Part of subcall function 0076B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00762194,00000034,?,?,00001004,00000000,00000000), ref: 0076B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 007627CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0076281A

Strings

@, xrefs: 00762832

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: c57093eb8033d4e61e4376b8c2a701488e8339dbdf5d8449d492ee04ff7c4f31
Instruction ID: 208e77c049ecb1b68597838de09104ce7cb815b4c6e4bc41a880dc53a073ee93
Opcode Fuzzy Hash: c57093eb8033d4e61e4376b8c2a701488e8339dbdf5d8449d492ee04ff7c4f31
Instruction Fuzzy Hash: FD410D76900218AFDB11DFA4CD45EEEBBB8EF05700F108095FA56B7181DB746E85CB61

Function 0073172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00731769
_free.LIBCMT ref: 00731834
_free.LIBCMT ref: 0073183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00731760, 00731767, 00731796, 007317CE

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: 00f59be5943c0b46d744ec857768301719f91e99f280843f202293c7579c2fc1
Instruction ID: 7e7111094fae95308eef390ff526a10ba037a0c2cc977f81f1102a0265b3ea2a
Opcode Fuzzy Hash: 00f59be5943c0b46d744ec857768301719f91e99f280843f202293c7579c2fc1
Instruction Fuzzy Hash: FB318075A00218FFEB21DB999C85D9EBBFCEB85320F9481A7F40497212D6789E40CB94

Function 0076C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0076C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0076C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,007D1990,010C5420), ref: 0076C395

Strings

0, xrefs: 0076C2DF

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: dce16f70706a6135da34941cd71f3193ecc38f39be6728313d1f6945b4a7ce56
Instruction ID: 5f790ca760f7de6e83541f336fd71f8fb40f6a9560314ba4222201cc5882d724
Opcode Fuzzy Hash: dce16f70706a6135da34941cd71f3193ecc38f39be6728313d1f6945b4a7ce56
Instruction Fuzzy Hash: BE418F31204301DFD721DF26D845B6ABBE8AB85310F14861EFDA6973D1D738E905CB66

Function 00794416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0079CC08,00000000,?,?,?,?), ref: 007944AA
GetWindowLongW.USER32 ref: 007944C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 007944D7

Strings

SysTreeView32, xrefs: 0079447C

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: d69862c42d5e352b453bfd6e558d5870cbbd79edd3135ad2b9384a276de11222
Instruction ID: 66163adec5f6de781a20d3ea8c9ef4accb94100de98550cd01d21553feeff915
Opcode Fuzzy Hash: d69862c42d5e352b453bfd6e558d5870cbbd79edd3135ad2b9384a276de11222
Instruction Fuzzy Hash: C131DE31200205AFDF218E78EC45FEA7BA9EB08334F204319F979921E0D778EC629B50

Function 00766E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00766EED
VariantCopyInd.OLEAUT32(?,?), ref: 00766F08
VariantClear.OLEAUT32(?), ref: 00766F12

Strings

*jv, xrefs: 00766E8B, 00766E90, 00766EF8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *jv
API String ID: 2173805711-3975105792
Opcode ID: dd6e226a1ef5316e45fe74caea179f12bd292da965113b276bd6e1c710efcab7
Instruction ID: c007abb9606d954757dbf04d006de9c68d5a179965a4423b35d81b5012ae2758
Opcode Fuzzy Hash: dd6e226a1ef5316e45fe74caea179f12bd292da965113b276bd6e1c710efcab7
Instruction Fuzzy Hash: F531AD72604245DBCB05AFA4E8959FE37B6FF84704B5005ADF8035B2A1CB3C9E12DB94

Function 0078304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0078335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00783077,?,?), ref: 00783378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0078307A
_wcslen.LIBCMT ref: 0078309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00783106

Strings

255.255.255.255, xrefs: 00783095, 0078309A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 81db4abb209aa17bde275aeb6830b1bb9710bd43eab1880a7076778b28e35f8a
Instruction ID: ca5902dabb93bbef5c9aadb32b522afa696ac481f7305db7e30219021f12eb07
Opcode Fuzzy Hash: 81db4abb209aa17bde275aeb6830b1bb9710bd43eab1880a7076778b28e35f8a
Instruction Fuzzy Hash: 7531D335604205DFCB10EF2CC489EAA77E1EF14B18F248159E9168B392DB7AEE42C760

Function 00793EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00793F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00793F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00793F78

Strings

SysMonthCal32, xrefs: 00793F0B

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 92677182f6083d94051e43c25e86dad2076dce5276ad17e1829073a2fb01389f
Instruction ID: 542098976f445323e9ea10553805f6820989b219768c08a5d08e5d4d9571a1c5
Opcode Fuzzy Hash: 92677182f6083d94051e43c25e86dad2076dce5276ad17e1829073a2fb01389f
Instruction Fuzzy Hash: 9B219F32600219BBDF269F50DC46FEA3B76EB48714F110215FA156B1D0D6B9A951CBA0

Function 00794653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00794705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00794713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0079471A

Strings

msctls_updown32, xrefs: 00794684

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 962a41e7ee779602ba1793d54ef184bf4437bd7977a829c3308e00d7ab7619b7
Instruction ID: 89852a868122cce20c4dfa087977cf7be7cea369d4e984d1dc2e2c0ff46f0580
Opcode Fuzzy Hash: 962a41e7ee779602ba1793d54ef184bf4437bd7977a829c3308e00d7ab7619b7
Instruction Fuzzy Hash: DB214CB5600208AFDB11DF64EC95DBA37ADEB5A394B440059FA009B291DB38EC12CA60

Function 007695AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0076961D

Strings

#OnAutoItStartRegister, xrefs: 007695F3
#requireadmin, xrefs: 007695D9
#notrayicon, xrefs: 007695B7

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 26f2385eae97054fe791ceb4beb6b2b6563dad261820d29e3b49b586b2b1fc8d
Instruction ID: 15679282cf958e4838065df58d405d0cd99c15d83d7718e47ab3d2f2dfb7bd8f
Opcode Fuzzy Hash: 26f2385eae97054fe791ceb4beb6b2b6563dad261820d29e3b49b586b2b1fc8d
Instruction Fuzzy Hash: 86212672604620A6C731AA24E806FB773DCDF51300F14402AFE5BA7082EB7DAD55C296

Function 007937B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00793840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00793850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00793876

Strings

Listbox, xrefs: 0079380F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 13750b056b4381fc35e6cdf939bfef9be3de92ee143b8c82a7a0e3798d1ea2aa
Instruction ID: 6b6cc2b80485cf5b1766d2bf89d5110f58a276b4a148a36b48db5830852545a6
Opcode Fuzzy Hash: 13750b056b4381fc35e6cdf939bfef9be3de92ee143b8c82a7a0e3798d1ea2aa
Instruction Fuzzy Hash: 8921A472610118BBEF21DF94DC85FBB376EEF89764F108115F9059B190C679DC5287A0

Function 007749F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00774A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00774A5C
SetErrorMode.KERNEL32(00000000,?,?,0079CC08), ref: 00774AD0

Strings

%lu, xrefs: 00774A6F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 882e90392f92b2ebd6bab3fe67837afb51162779cf4ce12753857f4826d81afe
Instruction ID: 9dbaaa11ebdcb5e296f287f22318d4e1beda70bdee652d00254e4f92039479a0
Opcode Fuzzy Hash: 882e90392f92b2ebd6bab3fe67837afb51162779cf4ce12753857f4826d81afe
Instruction Fuzzy Hash: 28313075A00109EFDB11DF64C885EAA7BF8EF04304F1580A9E909DB392D779ED46CB61

Function 007941EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0079424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00794264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00794271

Strings

msctls_trackbar32, xrefs: 00794226

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 7a3f003fcc96a9dd7ec00360211f4d9a14b82f6ce02d6c7c701a16354230d9e4
Instruction ID: 2d32b8d6ff0803a78acefa314915fc02f5f2f4f21ae945c3fea86ec44d0c43b4
Opcode Fuzzy Hash: 7a3f003fcc96a9dd7ec00360211f4d9a14b82f6ce02d6c7c701a16354230d9e4
Instruction Fuzzy Hash: E5110632240208BEEF209F29DC06FAB3BACFF85B64F110528FA55E2190D675DC529B20

Function 00762F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00706B57: _wcslen.LIBCMT ref: 00706B6A

Part of subcall function 00762DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00762DC5
Part of subcall function 00762DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00762DD6
Part of subcall function 00762DA7: GetCurrentThreadId.KERNEL32 ref: 00762DDD
Part of subcall function 00762DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00762DE4

GetFocus.USER32 ref: 00762F78

Part of subcall function 00762DEE: GetParent.USER32(00000000), ref: 00762DF9

GetClassNameW.USER32(?,?,00000100), ref: 00762FC3
EnumChildWindows.USER32(?,0076303B), ref: 00762FEB

Strings

%s%d, xrefs: 00762FFF

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 49c9ae8feaff690b16900ca7cb2912a28a3bd890942c63a59c22277da06a82c3
Instruction ID: 033e3dcbfa8d79805b5eeb6eec8c25ef5b31272ee93bf0057809c73746d30108
Opcode Fuzzy Hash: 49c9ae8feaff690b16900ca7cb2912a28a3bd890942c63a59c22277da06a82c3
Instruction Fuzzy Hash: 4B11C0B1300205EBDF556F60CC99EED37AAAF84304F148075FD0A9B292DE38994ACB70

Function 00795882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 007958C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 007958EE
DrawMenuBar.USER32(?), ref: 007958FD

Strings

0, xrefs: 0079588F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 54355a27df2ca9cb8f45de785680e1a1bf6ba22acc9545efdf229b6c518de5d6
Instruction ID: f816ed6f9a5a8b93635bf2c6aa51a2b784738b0c65450265c7b6ebb5af77bfa9
Opcode Fuzzy Hash: 54355a27df2ca9cb8f45de785680e1a1bf6ba22acc9545efdf229b6c518de5d6
Instruction Fuzzy Hash: CA018431500228EFDF129F15EC44BEEBBB4FF45760F108099E849D6151DB389A94DF21

Function 0076007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41a80a593d8bdf7ad1a414d7430bf2da412c8765f029589c51d35b8b3b99fcf
Instruction ID: 1abb453d1deb80e51408aa3baf7824a04de7999fe8461bf637e3d894525fef2a
Opcode Fuzzy Hash: a41a80a593d8bdf7ad1a414d7430bf2da412c8765f029589c51d35b8b3b99fcf
Instruction Fuzzy Hash: 3AC16D75A0020AEFDB14CFA8C898EAEB7B5FF48314F108598E906EB251D735ED41DB90

Function 0078342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00783459
CoUninitialize.OLE32 ref: 00783463
VariantInit.OLEAUT32(?), ref: 0078346E
VariantClear.OLEAUT32(?), ref: 0078371B

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: fde4823ad8f309fcba522cf38ea18e878afde6e0567c78cbfcf3b19d0bfd480f
Instruction ID: 1af5f84049824ba4e961c970b3ed239d383f487a199b5d645cf60296faee67fa
Opcode Fuzzy Hash: fde4823ad8f309fcba522cf38ea18e878afde6e0567c78cbfcf3b19d0bfd480f
Instruction Fuzzy Hash: 9EA14F75604301DFCB05EF28C889A6AB7E5FF88714F048959F9899B3A1DB38EE41CB51

Function 00760436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0079FC08,?), ref: 007605F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0079FC08,?), ref: 00760608
CLSIDFromProgID.OLE32(?,?,00000000,0079CC40,000000FF,?,00000000,00000800,00000000,?,0079FC08,?), ref: 0076062D
_memcmp.LIBVCRUNTIME ref: 0076064E

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 63ae7ac9f38084293e1aab0b18ad6bfd194c17c47346972ca817910db2e20a32
Instruction ID: cecab9d085c0c9f4333dca2064260285842cf157e4d61385ca9ba3dea3e9b7ad
Opcode Fuzzy Hash: 63ae7ac9f38084293e1aab0b18ad6bfd194c17c47346972ca817910db2e20a32
Instruction Fuzzy Hash: 32810C75A00109EFCF04DF94C988DEEB7B9FF89315F204558E906AB251DB75AE06CBA0

Function 00741391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007414C0

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 83de5bffd2dcbbbda58a096fe8e5069bb70a982308465341c59e67ad53d60b1b
Instruction ID: ba9050f0a8a75d28ff0ba90dd2cdb4507bda0d600de6b55a534ea2843565d619
Opcode Fuzzy Hash: 83de5bffd2dcbbbda58a096fe8e5069bb70a982308465341c59e67ad53d60b1b
Instruction Fuzzy Hash: 10412C32A40154EBEB217BFDAC49ABE3AF4FF42370F544236F419D6192E77C88815661

Function 00796278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 007962E2
ScreenToClient.USER32(?,?), ref: 00796315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00796382

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 9fd78ba9ae18b2246d84e6e5411b52e7808167af9640aab13c4091a818bfe0f2
Instruction ID: 22373301f3b603230f01ceaa5c0fb29679d43bda3cf6897aa7599df79769baaf
Opcode Fuzzy Hash: 9fd78ba9ae18b2246d84e6e5411b52e7808167af9640aab13c4091a818bfe0f2
Instruction Fuzzy Hash: D0515F75A00249EFDF11DF68E8819AE7BB5FF45360F10825AF9159B2A0D734ED81CB50

Function 00781AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00781AFD
WSAGetLastError.WSOCK32 ref: 00781B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00781B8A
WSAGetLastError.WSOCK32 ref: 00781B94

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 8425e966b7bbf88613793e5012e460ca924fa1413c411c8f25aeac01c347de59
Instruction ID: 083511a474089057c0497f146a0908ba4080c9aa14446108eaa12b6cce0e043c
Opcode Fuzzy Hash: 8425e966b7bbf88613793e5012e460ca924fa1413c411c8f25aeac01c347de59
Instruction Fuzzy Hash: 9F41D474640200EFE720AF24C88AF657BE5AB44718F54C558F91A9F3D2D77AED82CB90

Function 0073B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ac8b40d94a17ca8c39b1ea1666bedd1465778793436dfe5cfbeac11c3595ed0
Instruction ID: f8f61441d4097ea5e0b417b75fe5055c62d49942a00f4c778d3fd5c917582bf4
Opcode Fuzzy Hash: 5ac8b40d94a17ca8c39b1ea1666bedd1465778793436dfe5cfbeac11c3595ed0
Instruction Fuzzy Hash: 36411776A00354FFE724AF38CC45B6ABBE9EB88710F10452AF241DB283D779A9518780

Function 007756D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00775783
GetLastError.KERNEL32(?,00000000), ref: 007757A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 007757CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 007757FA

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 3dea21909d43ef416c269596e1bf0e5a42eeacffd113e889255769e71c5d832d
Instruction ID: d7a17619469735df4e4c4d92e359acb1391c58b902e3385bd09c9d87e6903994
Opcode Fuzzy Hash: 3dea21909d43ef416c269596e1bf0e5a42eeacffd113e889255769e71c5d832d
Instruction Fuzzy Hash: A5412F35600610DFCF15DF15C548A5DBBE2EF49320B19C988E84A5B3A2CB78FD41CB91

Function 0073D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00726D71,00000000,00000000,007282D9,?,007282D9,?,00000001,00726D71,?,00000001,007282D9,007282D9), ref: 0073D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0073D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0073D9AB
__freea.LIBCMT ref: 0073D9B4

Part of subcall function 00733820: RtlAllocateHeap.NTDLL(00000000,?,007D1444,?,0071FDF5,?,?,0070A976,00000010,007D1440,007013FC,?,007013C6,?,00701129), ref: 00733852

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 833af07a3a00feeac52f829e7e91d2c6ee6aa2a3c08a1bc24f50632c5becd9f3
Instruction ID: 5288ba8abb55f45047f30eaa47b05c88155b0bdf7efcf62e2afcfb6f48436e60
Opcode Fuzzy Hash: 833af07a3a00feeac52f829e7e91d2c6ee6aa2a3c08a1bc24f50632c5becd9f3
Instruction Fuzzy Hash: 0031CF72A0021AABEF25DF64EC45EAE7BA5EB40310F054169FC04D7252EB39ED51CBA0

Function 007952C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00795352
GetWindowLongW.USER32(?,000000F0), ref: 00795375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00795382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007953A8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: f61e59901e9d2efea7ba2c11d332ee4469c0cede474944e1acbd491ecb8cfe6d
Instruction ID: b76fe1173d85db752b44d5185500eb07e3234bff7fcff2eb0b117325e8e4d483
Opcode Fuzzy Hash: f61e59901e9d2efea7ba2c11d332ee4469c0cede474944e1acbd491ecb8cfe6d
Instruction Fuzzy Hash: 83310834A55A28FFEF329F54EC15FE83761AB05398F588102FA10961E1C7BC9D80DB51

Function 0076AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 0076ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0076AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0076AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 0076ACC6

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 9986e2e9f6913c47b6dee714e664151915478677517033b438e7b3db62672416
Instruction ID: c0ea41007369e815bd994ab0fb10db359bcb535c9eace2369461537d4c6c714f
Opcode Fuzzy Hash: 9986e2e9f6913c47b6dee714e664151915478677517033b438e7b3db62672416
Instruction Fuzzy Hash: E7310830A00618BFFF35CB658C09BFA7BA5AB45310F04421AE887A21D1D37D99859F72

Function 00797674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0079769A
GetWindowRect.USER32(?,?), ref: 00797710
PtInRect.USER32(?,?,00798B89), ref: 00797720
MessageBeep.USER32(00000000), ref: 0079778C

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 4e0e1e1bca6c3ee827617e592657e2c48b6b65971d16117df23b878c593f4122
Instruction ID: b4f7045c86b005445fbccba92ba7d98c2517459a55c0208254553642ef0c337c
Opcode Fuzzy Hash: 4e0e1e1bca6c3ee827617e592657e2c48b6b65971d16117df23b878c593f4122
Instruction Fuzzy Hash: 9A41C034619254EFCF05CF98E894EA977F4FF49310F5580A9E4149B261C338E942CF90

Function 007916DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 007916EB

Part of subcall function 00763A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00763A57
Part of subcall function 00763A3D: GetCurrentThreadId.KERNEL32 ref: 00763A5E
Part of subcall function 00763A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007625B3), ref: 00763A65

GetCaretPos.USER32(?), ref: 007916FF
ClientToScreen.USER32(00000000,?), ref: 0079174C
GetForegroundWindow.USER32 ref: 00791752

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: e3e9739220003e686fe6c07a6f735a753ccc1ed224f70a3eb962f730e1cbd041
Instruction ID: 223bc1d5fc9aae36ba6887397351b906deac8eeba09e24ca5362e2d2de1bc0c9
Opcode Fuzzy Hash: e3e9739220003e686fe6c07a6f735a753ccc1ed224f70a3eb962f730e1cbd041
Instruction Fuzzy Hash: EC319471D00149EFDB00DFA5C885CAEB7FDEF48304B5481AAE415E7251DB34AE41CBA0

Function 0076D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0076D501
Process32FirstW.KERNEL32(00000000,?), ref: 0076D50F
Process32NextW.KERNEL32(00000000,?), ref: 0076D52F
CloseHandle.KERNEL32(00000000), ref: 0076D5DC

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: c668a71f97e4488888ae3d11a109051bfedfd46fbc96917d7ac772022332fd3e
Instruction ID: fa896d1c4f3b7c98645d36419d46c9f47cfe8cee7c2079dd2e588b83bfa99d66
Opcode Fuzzy Hash: c668a71f97e4488888ae3d11a109051bfedfd46fbc96917d7ac772022332fd3e
Instruction Fuzzy Hash: 2931C471508300DFD311EF54C885AAFBBF8EF99344F14052DF682821E2EB759945CBA2

Function 00798FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00719BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00719BB2

GetCursorPos.USER32(?), ref: 00799001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00757711,?,?,?,?,?), ref: 00799016
GetCursorPos.USER32(?), ref: 0079905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00757711,?,?,?), ref: 00799094

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 68a329ee68990c4b9dd7a64c1f55bc81164c87c13ea0a7a47a863f5df506a0ca
Instruction ID: d3e2633b40c425041a3c917a70a464b6cd9413ea046a16da552c71f5ec5fc6dd
Opcode Fuzzy Hash: 68a329ee68990c4b9dd7a64c1f55bc81164c87c13ea0a7a47a863f5df506a0ca
Instruction Fuzzy Hash: CB21B135600018FFDF268F9DD858EEA7BB9EB49350F10405AF61547261C33AA9A1DB60

Function 0076D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0079CB68), ref: 0076D2FB
GetLastError.KERNEL32 ref: 0076D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0076D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0079CB68), ref: 0076D376

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 8483d3bcdbec73650e797ce9e864e2ab4eb2696e02ae9b30a0251a4b64649bad
Instruction ID: fe2bf9ffbe6593aa59cb6f44af35d170e634a015c0758862fb1f4ea5123fa144
Opcode Fuzzy Hash: 8483d3bcdbec73650e797ce9e864e2ab4eb2696e02ae9b30a0251a4b64649bad
Instruction Fuzzy Hash: AD219170A14201DFC720DF25C88586AB7E4AE55324F504A1DF89AC73E1E738DD46CB93

Function 00761571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00761014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0076102A
Part of subcall function 00761014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00761036
Part of subcall function 00761014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00761045
Part of subcall function 00761014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0076104C
Part of subcall function 00761014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00761062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 007615BE
_memcmp.LIBVCRUNTIME ref: 007615E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00761617
HeapFree.KERNEL32(00000000), ref: 0076161E

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 48b15b3f7e1badc3cec81370d83fd1af516145718ce50bc5b925b300014eb0e5
Instruction ID: dfb20ac7cdf1dc4e77b1733c1743c1aa24073530d49f414592d73df3ce2477f7
Opcode Fuzzy Hash: 48b15b3f7e1badc3cec81370d83fd1af516145718ce50bc5b925b300014eb0e5
Instruction Fuzzy Hash: 0C21A171E40108EFDF01DFA8C949BEEB7B8EF44354F498459E842A7241EB38AE05CB60

Function 00792782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0079280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00792824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00792832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00792840

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 35cb2958e196e9b5d4912dd6d797f3ceec8caab06f3d66a16f16cc1662912c07
Instruction ID: 76d88a5f65a10c564ce8dc2d9869464f1c21840551da61a9c2032207f37cce50
Opcode Fuzzy Hash: 35cb2958e196e9b5d4912dd6d797f3ceec8caab06f3d66a16f16cc1662912c07
Instruction Fuzzy Hash: DF21AE31204511BFDB15AB24D849FAA7BA5AF45324F248259E4268B6E3CB79EC43C790

Function 007678F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00768D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0076790A,?,000000FF,?,00768754,00000000,?,0000001C,?,?), ref: 00768D8C
Part of subcall function 00768D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00768DB2
Part of subcall function 00768D7D: lstrcmpiW.KERNEL32(00000000,?,0076790A,?,000000FF,?,00768754,00000000,?,0000001C,?,?), ref: 00768DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00768754,00000000,?,0000001C,?,?,00000000), ref: 00767923
lstrcpyW.KERNEL32(00000000,?), ref: 00767949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00768754,00000000,?,0000001C,?,?,00000000), ref: 00767984

Strings

cdecl, xrefs: 0076797B

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 321f66c231b433aa2bba6ee81ad2248a4906e14d9eb1de40102c3caebf422793
Instruction ID: a67f301955fa1a74a0722ec6c23b6175cbcefebe686d6e817204a4a848ee91ba
Opcode Fuzzy Hash: 321f66c231b433aa2bba6ee81ad2248a4906e14d9eb1de40102c3caebf422793
Instruction Fuzzy Hash: D011293A200301ABCF155F38C844D7A77E9FF45394B40802AFC43C72A4EB399801C765

Function 00797CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00797D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00797D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00797D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0077B7AD,00000000), ref: 00797D6B

Part of subcall function 00719BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00719BB2

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 32e8d5126b674f0986d112506650f518ef08b1bef2b564bf1c0e9603d114d61a
Instruction ID: 819b89e0c82dbe8851051efae29bd9212bdb68971deca35d1c62840de718cab3
Opcode Fuzzy Hash: 32e8d5126b674f0986d112506650f518ef08b1bef2b564bf1c0e9603d114d61a
Instruction Fuzzy Hash: 3D11CD71225654AFCF158F28EC04AA63BA4AF46360F218325F839CB2F0E7389D51DB60

Function 00795660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 007956BB
_wcslen.LIBCMT ref: 007956CD
_wcslen.LIBCMT ref: 007956D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00795816

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: bbd5eeeec076e389e0c3e93f3e50e528e73ec3566dee459c20f428e063de5601
Instruction ID: 26b665221c0424ebe4ea76aba1897a9e72e184119fb7387140eb9fcca0fed558
Opcode Fuzzy Hash: bbd5eeeec076e389e0c3e93f3e50e528e73ec3566dee459c20f428e063de5601
Instruction Fuzzy Hash: BA11D371600628A6DF21DF61EC85EEE77BCEF11B60B50806AF915D6081E778DA80CB64

Function 00731D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7ef5a5f38a929fa92c0666f285b55104441306d1a9edd24abfc9ec44f9ffb4
Instruction ID: ebe8c28b92cd3f1e5186d31dcdf8ad177c4bb1e8ed4d371964a58c278ac7e894
Opcode Fuzzy Hash: cb7ef5a5f38a929fa92c0666f285b55104441306d1a9edd24abfc9ec44f9ffb4
Instruction Fuzzy Hash: 8C01D1B231961A7EFA212A787CC4F27671DEF423B8F750326F521A11D3DB689C014274

Function 00761A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00761A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00761A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00761A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00761A8A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0cf8e91a6e0572fe97eb19c511c6c1ba92ad1f7a48002957f76679db5c9f1c90
Instruction ID: 20b95d5dd85ecc077f7056abf71e62bc48ea07b24a6194aae2275c3bb9cf3852
Opcode Fuzzy Hash: 0cf8e91a6e0572fe97eb19c511c6c1ba92ad1f7a48002957f76679db5c9f1c90
Instruction Fuzzy Hash: 2A11573A901219FFEB10DBA4CD88FADBB78EB08350F204092EA01B7290C6716E50DB94

Function 0076E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0076E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0076E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0076E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0076E24D

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 4bbe011e20ebec5b77297f0d18a203d64743bd4913abe51d71851b1404ca808d
Instruction ID: 4bacd2118daf286fbfcd0e6d44b48b1c2a39d2f7fe355812179c73b47737ebe3
Opcode Fuzzy Hash: 4bbe011e20ebec5b77297f0d18a203d64743bd4913abe51d71851b1404ca808d
Instruction Fuzzy Hash: 8A112B76904218BFCB019FA8DC09A9E7FBDBB45310F008216F815E3290D278CD0487B4

Function 0072D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0072CFF9,00000000,00000004,00000000), ref: 0072D218
GetLastError.KERNEL32 ref: 0072D224
__dosmaperr.LIBCMT ref: 0072D22B
ResumeThread.KERNEL32(00000000), ref: 0072D249

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 5d540d15dbec1ab67dc6ceb561568b74d411f08a67a9a2c69e84cc2bebd6b3ce
Instruction ID: c8c4f5d38273c8ba05d9975d12025ef79a20f12cd42e320264237d46dee50443
Opcode Fuzzy Hash: 5d540d15dbec1ab67dc6ceb561568b74d411f08a67a9a2c69e84cc2bebd6b3ce
Instruction Fuzzy Hash: E901D676405128FBDB315BA5EC0DBAE7AADEF81330F104219F925921D0DB788D01C6A1

Function 00799EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00719BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00719BB2

GetClientRect.USER32(?,?), ref: 00799F31
GetCursorPos.USER32(?), ref: 00799F3B
ScreenToClient.USER32(?,?), ref: 00799F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00799F7A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 9adb1663c8dcfe9b4d5e949b59c44216d0e189fc5ac60c9dcb59b26bb723ad80
Instruction ID: 4cbf155265a1991272d7441e1b126f674a7411cabe72c188d8d78a48252be3bf
Opcode Fuzzy Hash: 9adb1663c8dcfe9b4d5e949b59c44216d0e189fc5ac60c9dcb59b26bb723ad80
Instruction Fuzzy Hash: 1F115E3290051AFBEF11DF98E8499EEB7B9FB05311F504456FA01E3140D338BA92CBA5

Function 0070600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0070604C
GetStockObject.GDI32(00000011), ref: 00706060
SendMessageW.USER32(00000000,00000030,00000000), ref: 0070606A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: a7c9cb78151bf32709c542e41059ae788d1f78b8fd3da8ac141bec287c2f8e83
Instruction ID: 72afda662a3520c4ab8e3e3c9355f02ffbab305ef4e5a9aae1b4dc209bb418a4
Opcode Fuzzy Hash: a7c9cb78151bf32709c542e41059ae788d1f78b8fd3da8ac141bec287c2f8e83
Instruction Fuzzy Hash: 97116D72541549FFEF128FA4DC64EEABBA9EF083A4F044216FA1452150D73A9C60EBA4

Function 00723B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00723B56

Part of subcall function 00723AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00723AD2
Part of subcall function 00723AA3: ___AdjustPointer.LIBCMT ref: 00723AED

_UnwindNestedFrames.LIBCMT ref: 00723B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00723B7C
CallCatchBlock.LIBVCRUNTIME ref: 00723BA4

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 3f8baac40f38f05141233b87a149fcfa5c20654ca4bafea4f94e70eee5f90325
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 55012972100158FBDF126E95EC46EEB3F7AEF48754F044018FE4856121C73AE961DBA0

Function 00733073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,007013C6,00000000,00000000,?,0073301A,007013C6,00000000,00000000,00000000,?,0073328B,00000006,FlsSetValue), ref: 007330A5
GetLastError.KERNEL32(?,0073301A,007013C6,00000000,00000000,00000000,?,0073328B,00000006,FlsSetValue,007A2290,FlsSetValue,00000000,00000364,?,00732E46), ref: 007330B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0073301A,007013C6,00000000,00000000,00000000,?,0073328B,00000006,FlsSetValue,007A2290,FlsSetValue,00000000), ref: 007330BF

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: c6e5724527668037853f175e0750caa3a327bfb69454da8bae72a6373c1243e8
Instruction ID: 3022bb7469cbd66ce67bcb950f19e04f722b65e496c298385037cbf0176e00ce
Opcode Fuzzy Hash: c6e5724527668037853f175e0750caa3a327bfb69454da8bae72a6373c1243e8
Instruction Fuzzy Hash: 50017B32301626ABEF354B78AC84A577B9AAF05B71F204721F945E7251C72DD902C6E4

Function 00767464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0076747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00767497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 007674AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 007674CA

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 52c03e1507d2cded980d9b042d2fceb837dda005c6ccc00218b1446cb7b96531
Instruction ID: 0ad3c6c9393692007e18a1596deb9523e99bf0cde74e1239a4af972b38740db1
Opcode Fuzzy Hash: 52c03e1507d2cded980d9b042d2fceb837dda005c6ccc00218b1446cb7b96531
Instruction Fuzzy Hash: 7711A1B52053549BE7208F14DD0CB927FFCEB40B98F10856AAA17D6151DB78E904DB60

Function 0076B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0076ACD3,?,00008000), ref: 0076B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0076ACD3,?,00008000), ref: 0076B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0076ACD3,?,00008000), ref: 0076B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0076ACD3,?,00008000), ref: 0076B126

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 3e59085e5d376121402187c76842930da221c75eb1fe219da0e12633d783d124
Instruction ID: 1a9451094f81d5d6e5ab67c9d289fd7329f3422aaee44e00900099632ab802c2
Opcode Fuzzy Hash: 3e59085e5d376121402187c76842930da221c75eb1fe219da0e12633d783d124
Instruction Fuzzy Hash: 42115E71C0151CE7CF049FE4D9596EEBF78FF0B711F108086D942B2285CB3895918B59

Function 00797E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00797E33
ScreenToClient.USER32(?,?), ref: 00797E4B
ScreenToClient.USER32(?,?), ref: 00797E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00797E8A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 198771f2cc390b72fc9e056aacfced3cec6905c53695ef6a3a4228a67e83f25b
Instruction ID: 620207ef93dc3b0f47557dbe6aedc2c294650b99246d64ff0b0ccfce0a828fc0
Opcode Fuzzy Hash: 198771f2cc390b72fc9e056aacfced3cec6905c53695ef6a3a4228a67e83f25b
Instruction Fuzzy Hash: 9D1140B9D0024AAFDF41CF98D884AEEBBF9FB08310F509066E915E2210D735AA55CF94

Function 00762DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00762DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00762DD6
GetCurrentThreadId.KERNEL32 ref: 00762DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00762DE4

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 03422e342c3f9145e9935a2e07e4a22f27996371674e1c5d2638c248374b357d
Instruction ID: 25b0e48290dbc2355d109aae4d31432272ab549560567eb437af8fd788b1126e
Opcode Fuzzy Hash: 03422e342c3f9145e9935a2e07e4a22f27996371674e1c5d2638c248374b357d
Instruction Fuzzy Hash: DAE092712016247BDF211B729C0EFEB3E7CEF42BA1F404416F506D10919BA9C842C6B5

Function 00798863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00719639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00719693
Part of subcall function 00719639: SelectObject.GDI32(?,00000000), ref: 007196A2
Part of subcall function 00719639: BeginPath.GDI32(?), ref: 007196B9
Part of subcall function 00719639: SelectObject.GDI32(?,00000000), ref: 007196E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00798887
LineTo.GDI32(?,?,?), ref: 00798894
EndPath.GDI32(?), ref: 007988A4
StrokePath.GDI32(?), ref: 007988B2

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 0a42ba464e5e794b0e87fb72becae56d16ca145a12210e868f7ee727235aca47
Instruction ID: e7bbba84e4f55c959552ea35b84b1919ee8d72743b4f2305948925ceff0b044c
Opcode Fuzzy Hash: 0a42ba464e5e794b0e87fb72becae56d16ca145a12210e868f7ee727235aca47
Instruction Fuzzy Hash: 31F03A36042258FADF136F98AC09FCA3B69AF06310F44C002FA11651E1C77D5552CBB9

Function 007198B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 007198CC
SetTextColor.GDI32(?,?), ref: 007198D6
SetBkMode.GDI32(?,00000001), ref: 007198E9
GetStockObject.GDI32(00000005), ref: 007198F1

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 62618496d28efd6ac3c096742d3b4327016c30edf44c50cae7cc6329bbf09045
Instruction ID: 15e68ab3c58930be76ac6af3996a610916851c1ef10c88db564f42c229a39bc6
Opcode Fuzzy Hash: 62618496d28efd6ac3c096742d3b4327016c30edf44c50cae7cc6329bbf09045
Instruction Fuzzy Hash: 82E06531284284ABDF225B74BC09BD83F10AB11336F14C21AF7FA540E1C7794656DB14

Function 0076162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00761634
OpenThreadToken.ADVAPI32(00000000,?,?,?,007611D9), ref: 0076163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,007611D9), ref: 00761648
OpenProcessToken.ADVAPI32(00000000,?,?,?,007611D9), ref: 0076164F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 30bf8eace3dae4a93af4361685729c29f51ab4f99fd6709d11b833bb4a2f5e20
Instruction ID: 0c2e4cfa597e0e3411580e25f532644ef8cf8820496d27ecc877e1a842812c6c
Opcode Fuzzy Hash: 30bf8eace3dae4a93af4361685729c29f51ab4f99fd6709d11b833bb4a2f5e20
Instruction Fuzzy Hash: 21E08635601211EBDF201FA49E0DB463B7CAF44791F18C809F646C9080DA3C4442C768

Function 0075D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0075D858
GetDC.USER32(00000000), ref: 0075D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0075D882
ReleaseDC.USER32(?), ref: 0075D8A3

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: aa4539626b0cd13a67a34813e5768ced331778af6b4c18ab9c5ab51b781b264f
Instruction ID: f47d573fff518af89bf55fa3b0d2f6811fafa02b824f14156a70862413eb15e0
Opcode Fuzzy Hash: aa4539626b0cd13a67a34813e5768ced331778af6b4c18ab9c5ab51b781b264f
Instruction Fuzzy Hash: 61E01AB1800205DFCF529FA4D80C66DBBB1FB08311F14C00AE806E7250CB3D9942AF54

Function 0075D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0075D86C
GetDC.USER32(00000000), ref: 0075D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0075D882
ReleaseDC.USER32(?), ref: 0075D8A3

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 582d8bc828069f354b04d531cf6bce1fa9e60182f23c415e7c6a54470c295eee
Instruction ID: 1bd49285ec1dcac16ae3defd51bfe333b6bf036ecafa7a60a0fcce168119a79c
Opcode Fuzzy Hash: 582d8bc828069f354b04d531cf6bce1fa9e60182f23c415e7c6a54470c295eee
Instruction Fuzzy Hash: EAE092B5800205EFCF52AFA4D80C66DBBB5BB08311F14954AE94AE7290DB3DA942AF54

Function 00774D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00707620: _wcslen.LIBCMT ref: 00707625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00774ED4

Strings

*, xrefs: 00774E10
LPT, xrefs: 00774DFB

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 4766ddccd9097e55811e8ae1a98fe7db2573aa69361923a9613a4e84750512e5
Instruction ID: b0f2c859766c723bc7f89178c1f748a75014b4b0916faa8eb4456d96c1671e09
Opcode Fuzzy Hash: 4766ddccd9097e55811e8ae1a98fe7db2573aa69361923a9613a4e84750512e5
Instruction Fuzzy Hash: F5914F75A00204DFCB14DF58C484EAABBF1AF45354F19C099E40A9F3A2D779ED85CB91

Function 0072E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0072E30D

Strings

pow, xrefs: 0072E2E5, 0072E302

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 1a88bc8b0de8f602c59c1ab3208ff26d0d59eea106f6273432b6158dcc4b6f52
Instruction ID: db63a0f3cf686d6314ca15daac884ad3203ae0741cf32d1649ccc31f64b4c37b
Opcode Fuzzy Hash: 1a88bc8b0de8f602c59c1ab3208ff26d0d59eea106f6273432b6158dcc4b6f52
Instruction Fuzzy Hash: 345180E1A1C102D6EB39B718ED453793BA4EF40741F308958F4D6462EBEB3D8C81DA46

Function 00787771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0075569E,00000000,?,0079CC08,?,00000000,00000000), ref: 007878DD

Part of subcall function 00706B57: _wcslen.LIBCMT ref: 00706B6A

CharUpperBuffW.USER32(0075569E,00000000,?,0079CC08,00000000,?,00000000,00000000), ref: 0078783B

Strings

<s|, xrefs: 007877C8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <s|
API String ID: 3544283678-2408698564
Opcode ID: 2ee6f293f38dcf81590dadeeab0fc4d311f5f7be6aab73a69f34197a1e2d8b27
Instruction ID: 20ce6976da44fd6cf6fdc0c53e068bd3e541a84215595a174a5775d2d2755b25
Opcode Fuzzy Hash: 2ee6f293f38dcf81590dadeeab0fc4d311f5f7be6aab73a69f34197a1e2d8b27
Instruction Fuzzy Hash: F4612E72954219EACF09FBA4CC95DFDB3B8BF14700B544229E543A71D1EF38AA45CBA0

Function 0071E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0071E1B1

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 1096a0a596b03d28d4405dd522579a8c0edfe86920556b436bb7787c02487668
Instruction ID: fac7f0df898cfa2557e85548c5af8b3b4e6378943e154320294702d44b156651
Opcode Fuzzy Hash: 1096a0a596b03d28d4405dd522579a8c0edfe86920556b436bb7787c02487668
Instruction Fuzzy Hash: 13515271900256DFDB19DF28C091AFA7BA8FF19310F248415FC919B2C0DA7C9E86CBA0

Function 0071F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0071F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 0071F2BB

Strings

@, xrefs: 0071F2AF

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 8efcffff956792ab538e8cf6f83ec60e7a66333e3024ee517f72ffe924012c28
Instruction ID: 759c0322980b015ac703704a3c7b4c033dc6a8b7d2531de174c92989b4a9e0a8
Opcode Fuzzy Hash: 8efcffff956792ab538e8cf6f83ec60e7a66333e3024ee517f72ffe924012c28
Instruction Fuzzy Hash: D7512772408745DBD320AF10D88ABABBBF8FB84300F818A5DF19941195EB749529CB67

Function 00785745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 007857E0
_wcslen.LIBCMT ref: 007857EC

Strings

CALLARGARRAY, xrefs: 007857E6, 007857EB

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 97a6db6042a532d9ae384965d98a32495e9845d99e960a18c1d051f77e46c225
Instruction ID: 36e6eb978c583e43ff77ef27962fed673ecde4b57c7153c2534e242ca427ef7e
Opcode Fuzzy Hash: 97a6db6042a532d9ae384965d98a32495e9845d99e960a18c1d051f77e46c225
Instruction Fuzzy Hash: 6F419D31A40209DFCB04EFA8C8859AEBBF5EF59320F10416AE505A7291E7789D81CBA0

Function 0077D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0077D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0077D13A

Strings

|, xrefs: 0077D10B

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: ff78a221e23296f176793b0e83cae3cbd089d68207285272c1bea4911d0a2908
Instruction ID: d2f60cb8892369ea6f2e2c82adc380ccf0ffa7cd0ce7522a82b643200eef464b
Opcode Fuzzy Hash: ff78a221e23296f176793b0e83cae3cbd089d68207285272c1bea4911d0a2908
Instruction Fuzzy Hash: 0E313071D00219EBCF15EFA4CC89AEE7FB9FF04340F404119F919A61A2E739A956CB60

Function 0079356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00793621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0079365C

Strings

static, xrefs: 007935BC

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 1aad74f5625e60d71e400aaf49cf2928d0045e005677c31097a4f548cfe28572
Instruction ID: 0642f1f5fc60686db2bec77392173ae7fa2a45e33e465991569afa6bcb05aecb
Opcode Fuzzy Hash: 1aad74f5625e60d71e400aaf49cf2928d0045e005677c31097a4f548cfe28572
Instruction Fuzzy Hash: 62318D71100604AADF10DF78EC81EFB73A9FF88724F009619F8A5D7280DA39AD91D760

Function 00794537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0079461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00794634

Strings

', xrefs: 0079458E

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: cc4a884f4712e469e016a9bf1fde3e0405a66653af4c8cfaa038d48100bfe805
Instruction ID: 730b1abec8fb2a42f3b1ff864b80f080653ff5153a4e5e806c07e92786adf670
Opcode Fuzzy Hash: cc4a884f4712e469e016a9bf1fde3e0405a66653af4c8cfaa038d48100bfe805
Instruction Fuzzy Hash: 9E3148B5A01209AFDF14CFA9D990FDA7BB5FF09300F11416AE904AB341D734A952CF90

Function 007931EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0079327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00793287

Strings

Combobox, xrefs: 00793249

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 23ccd10cdb54e13695d22fb25cb45528b319eaf6de557e865a763c729c9b3c5c
Instruction ID: 03fe1b01f8bddba311d5faa4f1125ddd2132d8abefe2b5fc22d4db77979ffffc
Opcode Fuzzy Hash: 23ccd10cdb54e13695d22fb25cb45528b319eaf6de557e865a763c729c9b3c5c
Instruction Fuzzy Hash: 4011B271300208BFFF25DF94EC84EBB3BAAFB94364F104129F91897290D6399D518760

Function 00793710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0070600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0070604C
Part of subcall function 0070600E: GetStockObject.GDI32(00000011), ref: 00706060
Part of subcall function 0070600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0070606A

GetWindowRect.USER32(00000000,?), ref: 0079377A
GetSysColor.USER32(00000012), ref: 00793794

Strings

static, xrefs: 00793757

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 6125cd42fd3ab620c38f418337c6a0ed3a9793ba271912624e3ef7e8806ffefe
Instruction ID: 371b55861e451eb338e52746da79d4a7bfcc62773b54aac2a7e7d2a25feb05b8
Opcode Fuzzy Hash: 6125cd42fd3ab620c38f418337c6a0ed3a9793ba271912624e3ef7e8806ffefe
Instruction Fuzzy Hash: 781137B2610209AFDF01DFB8DC86EEA7BF8FB08314F004915F955E2250E739E8619B60

Function 0077CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0077CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0077CDA6

Strings

<local>, xrefs: 0077CD66

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 17c0059f5b95f66c509a50886c96c90de4e5e2e53e345a4e36cb2a131cb69533
Instruction ID: 28e6d202965c43414be2bacd24c2efb4b0a31d5e685f33e02c64b0d9eb2cff6c
Opcode Fuzzy Hash: 17c0059f5b95f66c509a50886c96c90de4e5e2e53e345a4e36cb2a131cb69533
Instruction Fuzzy Hash: AD11A371305631BADB364A668C45EE7BEA8EB1A7E4F00822EB10D82180D6689841D6F0

Function 00793429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 007934AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007934BA

Strings

edit, xrefs: 0079348F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: c49744a53165de2335519da119a3abf3b49ee194340727e0c119389b976690c2
Instruction ID: 00feced8b296c065c8930d69715bdbc9d3475105495e568fa6cc185b57f587d2
Opcode Fuzzy Hash: c49744a53165de2335519da119a3abf3b49ee194340727e0c119389b976690c2
Instruction Fuzzy Hash: 7E118C71100248ABEF128F64EC44ABB3BAAEB05378F518724F965931E0C779EC519B64

Function 00766C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

CharUpperBuffW.USER32(?,?,?), ref: 00766CB6
_wcslen.LIBCMT ref: 00766CC2

Strings

STOP, xrefs: 00766CBC, 00766CC1

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: f3a03238c3142ba144cad87a02745878891848366c327a0660a741ffbb1de11b
Instruction ID: 4862b81aa9de1723f5e36f510333dcb97ee23d9bba82dc5b7039fef469b0cfde
Opcode Fuzzy Hash: f3a03238c3142ba144cad87a02745878891848366c327a0660a741ffbb1de11b
Instruction Fuzzy Hash: C301C032A00926CACB21AFBDDC959BF77A5EF61710B900528ED63961D1EB39E940C660

Function 00761CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

Part of subcall function 00763CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00763CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00761D4C

Strings

ComboBox, xrefs: 00761CEB
ListBox, xrefs: 00761D16

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 42168789208e2d1ae5ac2a1143175d5ab7cf767d192c69510add0af9dd20e05b
Instruction ID: 4e05dba166bf3995db8243288c5173ad0df272426bfc2f55128c7f9293c6cd78
Opcode Fuzzy Hash: 42168789208e2d1ae5ac2a1143175d5ab7cf767d192c69510add0af9dd20e05b
Instruction Fuzzy Hash: A0019271601214EBCB04ABA4CC59DFE77A8AB56350B440A19BD23672C2EA3959088660

Function 00761BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

Part of subcall function 00763CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00763CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00761C46

Strings

ComboBox, xrefs: 00761BE5
ListBox, xrefs: 00761C10

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: cfdc3c991d7b3244b0a5fa169e7a588529122e42c0e3ce2214549b0a87181f81
Instruction ID: 04fbae3a86b6985f4f85448041ae7aa5cc88f4ec83ef24c6e45e7b8827510a5e
Opcode Fuzzy Hash: cfdc3c991d7b3244b0a5fa169e7a588529122e42c0e3ce2214549b0a87181f81
Instruction Fuzzy Hash: D401A7B5A81104E6DB04EBA0C95AEFF77E89B11340F540019BD17672C2EA2D9E18D7B1

Function 00761C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

Part of subcall function 00763CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00763CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00761CC8

Strings

ComboBox, xrefs: 00761C69
ListBox, xrefs: 00761C94

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 5e97157cd4416baaed8886cbbbfa769511f92a159590899355fb7f8ad14a459c
Instruction ID: fc17d13f72a58d30eaad32fd716080e56bd31f7d0a42bb3257daed71f7d5e32d
Opcode Fuzzy Hash: 5e97157cd4416baaed8886cbbbfa769511f92a159590899355fb7f8ad14a459c
Instruction Fuzzy Hash: 4C01D6B1A80158E7DB04EBA0CA09EFF77E89B11340F580419BD03732C2EA2D9F08D671

Function 0071A4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0071A529

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

Strings

,%}, xrefs: 0071A509
3yu, xrefs: 0071A545, 0071A54D, 0071A552

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%}$3yu
API String ID: 2551934079-347936961
Opcode ID: 94d8c35a14993a5f23fb654ff8da6b6e6243461261430ef3ef80c8b9cafafce3
Instruction ID: fc97476ec1df033fbd152875bb1dba91a4a856288fdd1aefd6f9de898750e180
Opcode Fuzzy Hash: 94d8c35a14993a5f23fb654ff8da6b6e6243461261430ef3ef80c8b9cafafce3
Instruction Fuzzy Hash: 7701F731B06610EBCB00F76CA85FA9D33659B05750F504065F602572C3EE6C5D9286E7

Function 00761D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00709CB3: _wcslen.LIBCMT ref: 00709CBD

Part of subcall function 00763CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00763CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00761DD3

Strings

ComboBox, xrefs: 00761D75
ListBox, xrefs: 00761DA0

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 32d760aff6ddd6285ff250ab7ed8a6ea7ac6a61b58fdc51ae6672adeea67d2fd
Instruction ID: c87b6b1f1dcf13325357512c7f992625c7b632489a79bcc3a9a59cec4c165ce4
Opcode Fuzzy Hash: 32d760aff6ddd6285ff250ab7ed8a6ea7ac6a61b58fdc51ae6672adeea67d2fd
Instruction Fuzzy Hash: 76F049B1F41214E6DB14E7A4CD59FFF77A8AB11350F440919BD23672C2DB6959088770

Function 00798172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,007D3018,007D305C), ref: 007981BF
CloseHandle.KERNEL32 ref: 007981D1

Strings

\0}, xrefs: 0079818A

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0}
API String ID: 3712363035-1796552116
Opcode ID: 3e06f57b887d4d4eca668d6d48309c49453150f9ee970c20ccd3610d421685cd
Instruction ID: 093467c986b53ba450a028d33ca371846265aa7f1932682456498fd97b0d34e3
Opcode Fuzzy Hash: 3e06f57b887d4d4eca668d6d48309c49453150f9ee970c20ccd3610d421685cd
Instruction Fuzzy Hash: 63F05EB1641314BBF720A761AC49FB73B6DDB05750F008422BB08D51A2D67D8A0183BE

Function 0078747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00787493
_wcslen.LIBCMT ref: 007874B9

Strings

3, 3, 16, 1, xrefs: 00787483

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 03e8c4b3329bdddc055b49e66b239c2742bbd9b38d5ef9c8231579595139c034
Instruction ID: a216f3a3e9f8479b3a38b0e73676a596183ce47250c07631584695c005ad2bc9
Opcode Fuzzy Hash: 03e8c4b3329bdddc055b49e66b239c2742bbd9b38d5ef9c8231579595139c034
Instruction Fuzzy Hash: 4AE02B422442B060923932B9ACC5A7F5689CFC5760734182FF9CAC2266EADCDDD1D3A0

Function 00760B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00760B23

Strings

AutoIt, xrefs: 00760B17
Error allocating memory., xrefs: 00760B1C

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: dd08c7ac630a223fe02148f95625a6a9f9c0ead7042db6b1ea19318c42137cb6
Instruction ID: 4d6644b7635bcca4fb9b49b0782a37d3ee0da2828f454b0d0c967f49848b4ab1
Opcode Fuzzy Hash: dd08c7ac630a223fe02148f95625a6a9f9c0ead7042db6b1ea19318c42137cb6
Instruction Fuzzy Hash: D0E0D831244318B6DA1137947C0BFC97B848F05B20F10446AFB88554C38AEA349006F9

Function 00720D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0071F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00720D71,?,?,?,0070100A), ref: 0071F7CE

IsDebuggerPresent.KERNEL32(?,?,?,0070100A), ref: 00720D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0070100A), ref: 00720D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00720D7F

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: f29998382c91e652c16dad16990121a8c80bb31b7b3dd1a875586ef778e368e6
Instruction ID: 99a68a1f218288c8cdc85a82c839e0bf2a58d2bae5f49850e7525844b3621e12
Opcode Fuzzy Hash: f29998382c91e652c16dad16990121a8c80bb31b7b3dd1a875586ef778e368e6
Instruction Fuzzy Hash: 00E06D702013118BDB209FB8E8083427BE0BB00750F00893EE482C6692DBBCE4458BE1

Function 0071E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0071E3D5

Strings

8%}, xrefs: 0071E3CA
0%}, xrefs: 0071E3B5

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%}$8%}
API String ID: 1385522511-2688785392
Opcode ID: f642bbd5c47ea6816f1ddd00b5b0d01a9769f73c86e008d6e278c9f1d701e7d2
Instruction ID: 0a4def383946e59a06b7d36d1f2d692c29d79662ac50a2779ae418292758aed8
Opcode Fuzzy Hash: f642bbd5c47ea6816f1ddd00b5b0d01a9769f73c86e008d6e278c9f1d701e7d2
Instruction Fuzzy Hash: ADE08631419A24CBC704971CB85DEC83375BB55720B5052F7E923872D3DB3C689386A9

Function 00773017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0077302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00773044

Strings

aut, xrefs: 00773038

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 58555908a0eae7fdf910019e0645952c19ca2b55ee7f7378bf639a68c87b118c
Instruction ID: f35556ee28e8781fd0cd024ca35b8a25a8bbc306aecfa5dc621937fabfec24cf
Opcode Fuzzy Hash: 58555908a0eae7fdf910019e0645952c19ca2b55ee7f7378bf639a68c87b118c
Instruction Fuzzy Hash: E5D05EB250032877DE20A7A4AC4EFCB3B6CEB04750F0042A2B655E6091DAB89985CBE4

Function 0075D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0075D220

Strings

%.3d, xrefs: 0075D22B
X64, xrefs: 0075D2A8

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 6d90e8d5c912c073f3fc5a872004ec8e5df3380e0f34689db0b2ef727c569fc9
Instruction ID: 8b46af6b1154d82e5235f85036528b7790f7dfcfb683b59993885076f2a355d0
Opcode Fuzzy Hash: 6d90e8d5c912c073f3fc5a872004ec8e5df3380e0f34689db0b2ef727c569fc9
Instruction Fuzzy Hash: D5D012B1C08148E9CB7097E0CC499F9B37CBB08302F508456FD0691040D6ACDD4CAB61

Function 00792356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0079236C
PostMessageW.USER32(00000000), ref: 00792373

Part of subcall function 0076E97B: Sleep.KERNELBASE ref: 0076E9F3

Strings

Shell_TrayWnd, xrefs: 00792365

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 17201814d5c8e6cc51afb2c91ab4cc8477190557951e8dbfcf7ce887c29fa299
Instruction ID: e0ccd6cefb0ab1fc4cf2c5ccd5152a93639d0a0b2a863df0c39432ebc31f2698
Opcode Fuzzy Hash: 17201814d5c8e6cc51afb2c91ab4cc8477190557951e8dbfcf7ce887c29fa299
Instruction Fuzzy Hash: 14D0C976381310BAEA65A7709C4FFC666249B04B10F11896A7646AA1D4C9A8B8128A58

Function 00792322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0079232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0079233F

Part of subcall function 0076E97B: Sleep.KERNELBASE ref: 0076E9F3

Strings

Shell_TrayWnd, xrefs: 00792325

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 0ec6003b0897b3db4236d87dc569c4ee2643fe26ac29146461613cbf9867fd5b
Instruction ID: 302a4534075deba0410599d960366077678e17f653b1ed1a674b18e21a90076e
Opcode Fuzzy Hash: 0ec6003b0897b3db4236d87dc569c4ee2643fe26ac29146461613cbf9867fd5b
Instruction Fuzzy Hash: C6D01276394310B7EA64B770DC4FFC67A249F00B10F11896B7746AA1D4C9F8B812CA58

Function 0073BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0073BE93
GetLastError.KERNEL32 ref: 0073BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0073BEFC

Memory Dump Source

Source File: 00000000.00000002.2892273871.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.2892257957.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892340301.00000000007C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892396433.00000000007CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2892460863.00000000007D4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 4297c0073607548af03b681032b8719fd0bb3115d5b18b1b3d9e858478722e72
Instruction ID: cc90548c8129fbdd96b7704c5d7aa040060bccca2f77f73ff6266c793bcdfd44
Opcode Fuzzy Hash: 4297c0073607548af03b681032b8719fd0bb3115d5b18b1b3d9e858478722e72
Instruction Fuzzy Hash: 11410975600217EFEF218F68CC94ABA7BA4EF41310F14516AFA59971A3DB388D01CB61

Source: Joe Sandbox View	IP Address: 13.107.246.42 13.107.246.42
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725450614&P2=404&P3=2&P4=XToCa%2fQ5PRkCvqJJYUHBCmocjJ7OcFPCaGwhzGhWXpBLw%2bBKrigHVygrIXmSt1nZRhmuaWHq6CB1CWtZY41Rog%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: jHlsqcRllQWYhFvwfIMyZKSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveContent-Length: 940Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.132

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\0cb76709-3931-498e-9e99-404216b60714.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2ef2b9a3-bf70-42eb-a558-c69293cc419b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4b1d6820-7f4a-4d05-8a6b-c9c4d2c79236.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4e72844c-b573-4072-8f0c-b285bc2e922d.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\53cab272-152b-4ce8-8e09-92b882dfc629.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\604ad75a-fdc1-46cb-843e-d156c2817be8.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6c6bd348-1521-4ec9-acb1-68512afc44ad.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\9899878a-70fb-4968-86b8-da849062cc78.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\f17172c5-dfec-4811-8901-a5909b1be7d0.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66CF0EE1-1D08.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66CF0EE2-1E10.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\22d57165-0ae6-4930-9b91-cf66638d69c2.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\2c695320-6ec7-49e0-9d8f-affe1a8fbce8.tmp

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre