Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1500629
MD5:	dc12b6f6672fb5207663bdc61e10f8aa
SHA1:	d5c078b706871bc9ad4a7fbb1557ada47c818b95
SHA256:	1ab5b718a73e9f1b5025ab9b1ce5cee5bb3d5773777f3cf65ba0ef824cfe0925
Tags:	exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6472 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DC12B6F6672FB5207663BDC61E10F8AA)

msedge.exe (PID: 5852 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5304 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2064,i,13060568358319835926,5078487426921904153,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1096 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7392 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2052,i,533442361611148287,17102799545326490740,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8608 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7160 --field-trial-handle=2052,i,533442361611148287,17102799545326490740,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8620 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7284 --field-trial-handle=2052,i,533442361611148287,17102799545326490740,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9024 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4040 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2016,i,1888762196936444525,4492717181873450465,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7188 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=2640 --field-trial-handle=2016,i,1888762196936444525,4492717181873450465,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6020 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8452 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3044 --field-trial-handle=2052,i,11996042725271471697,10916187422809690025,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.3323949264.0000000001101000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3323949264.00000000010D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.6.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.6.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.6.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.5.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.5.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Web Data.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.6.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.6.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.6.dr	String found in binary or memory: https://msn.com
Source: Web Data.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Top Sites.5.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.5.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49750 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ECEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00ECEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ECED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00ECED6A

Source: C:\Users\user\Desktop\file.exe

0_2_00ECEAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EBAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00EBAA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EE9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00EE9576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_cc1ecb61-5
Source: file.exe, 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_37549eee-f
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_638a9bc4-c
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1ba716ef-b

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EBD5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00EBD5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EB1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00EB1201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EBE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00EBE8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E58060	0_2_00E58060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC2046	0_2_00EC2046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB8298	0_2_00EB8298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8E4FF	0_2_00E8E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8676B	0_2_00E8676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE4873	0_2_00EE4873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E5CAF0	0_2_00E5CAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E7CAA0	0_2_00E7CAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E6CC39	0_2_00E6CC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E86DD9	0_2_00E86DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E6D073	0_2_00E6D073
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E591C0	0_2_00E591C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E6B119	0_2_00E6B119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E71394	0_2_00E71394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E71706	0_2_00E71706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E7781B	0_2_00E7781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E719B0	0_2_00E719B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E6997D	0_2_00E6997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E57920	0_2_00E57920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E77A4A	0_2_00E77A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E77CA7	0_2_00E77CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E71C77	0_2_00E71C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E89EEE	0_2_00E89EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDBE44	0_2_00EDBE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E71F32	0_2_00E71F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00E59CB3 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00E6F9F2 appears 40 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00E70A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.evad.winEXE@69/305@12/8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EC37B5 GetLastError,FormatMessageW,

0_2_00EC37B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB10BF AdjustTokenPrivileges,CloseHandle,		0_2_00EB10BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00EB16C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EC51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00EC51CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EDA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00EDA67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EC648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00EC648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E542A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00E542A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\14eb48c8-8604-4d20-9094-72a42ce2d2fe.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.5.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2064,i,13060568358319835926,5078487426921904153,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2052,i,533442361611148287,17102799545326490740,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7160 --field-trial-handle=2052,i,533442361611148287,17102799545326490740,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7284 --field-trial-handle=2052,i,533442361611148287,17102799545326490740,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2016,i,1888762196936444525,4492717181873450465,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=2640 --field-trial-handle=2016,i,1888762196936444525,4492717181873450465,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3044 --field-trial-handle=2052,i,11996042725271471697,10916187422809690025,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2064,i,13060568358319835926,5078487426921904153,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2052,i,533442361611148287,17102799545326490740,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7160 --field-trial-handle=2052,i,533442361611148287,17102799545326490740,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7284 --field-trial-handle=2052,i,533442361611148287,17102799545326490740,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2016,i,1888762196936444525,4492717181873450465,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=2640 --field-trial-handle=2016,i,1888762196936444525,4492717181873450465,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3044 --field-trial-handle=2052,i,11996042725271471697,10916187422809690025,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00E542DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E70A76 push ecx; ret

0_2_00E70A89

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_E81D8DD3EACFA71E827377A4597DF902			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_E81D8DD3EACFA71E827377A4597DF902			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E6F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00E6F98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00EE1C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95598

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6537

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.2 %

Source: C:\Users\user\Desktop\file.exe TID: 4112

Thread sleep time: -65370s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6537 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EBDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00EBDBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8C2A2 FindFirstFileExW,	0_2_00E8C2A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC68EE FindFirstFileW,FindClose,	0_2_00EC68EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00EC698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EBD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00EBD076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EBD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00EBD3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00EC9642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00EC979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00EC9B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00EC5C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00E542DE

Source: Web Data.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.12.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.12.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.12.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.12.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Web Data.12.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.12.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.12.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.12.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.12.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.12.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.12.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.12.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.12.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.12.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.12.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.12.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.12.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.12.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.12.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.12.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.12.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.12.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.12.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Web Data.12.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.12.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Web Data.12.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.12.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-95719

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ECEAA2 BlockInput,

0_2_00ECEAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E82622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00E82622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00E542DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E74CE8 mov eax, dword ptr fs:[00000030h]

0_2_00E74CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EB0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00EB0B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E82622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E82622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E7083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E7083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E709D5 SetUnhandledExceptionFilter,	0_2_00E709D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E70C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00E70C21

Source: C:\Users\user\Desktop\file.exe

0_2_00EB1201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E92BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00E92BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EBB226 SendInput,keybd_event,

0_2_00EBB226

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00ED22DA

Source: C:\Users\user\Desktop\file.exe

0_2_00EB0B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EB1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00EB1663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E70698 cpuid

0_2_00E70698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EC8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00EC8195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EAD27A GetUserNameW,

0_2_00EAD27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E8B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_00E8B952

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E542DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00E542DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00ED1204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00ED1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Process Injection	1 Masquerading	LSA Secrets	221 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.5.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.5.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.5.dr	false	Avira URL Cloud: safe	unknown
https://www.office.com/Office	Top Sites.5.dr	false	Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.6.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.5.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.5.dr	false	Avira URL Cloud: safe	unknown
https://msn.com	data_10.6.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.5.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.5.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.46	unknown	United States	15169	GOOGLEUS	false
142.251.40.238	unknown	United States	15169	GOOGLEUS	false
142.251.40.228	unknown	United States	15169	GOOGLEUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500629
Start date and time:	2024-08-28 18:50:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@69/305@12/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 40 Number of non-executed functions: 316
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 142.251.173.84, 13.107.21.239, 204.79.197.239, 13.107.6.158, 2.19.126.145, 2.19.126.143, 216.58.212.163, 142.250.185.67, 2.23.209.161, 2.23.209.173, 2.23.209.169, 2.23.209.167, 2.23.209.174, 2.23.209.166, 2.23.209.178, 2.23.209.162, 2.23.209.175, 20.199.58.43, 199.232.214.172, 192.229.221.95, 173.194.76.84, 142.250.80.35, 142.251.32.99, 142.251.40.163, 142.251.35.163
Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, iris-de-prod-azsc-v2-frc.francecentral.cloudapp.azure.com, arc.msn.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, ctldl.windowsupdate.com, b-0005.b-msedge.net, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, l-0007.config.skype.com, edgeassetservice.azureedge.net, azureedge-t-prod.trafficmanager.net, business.bing.com, dual-a-0036.a-msedge.net
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
18:51:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_E81D8DD3EACFA71E827377A4597DF902 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
18:51:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_E81D8DD3EACFA71E827377A4597DF902 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://iv1tm.ykrbkt.ru/iV1TM/#hans.wurst@us.com	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
239.255.255.250	https://cb1cd44761364cecb21c459c42a86757.svc.dynamics.com/t/t/oIX7RshqCPFFtVxUphHklxDHFg31zySxgRv75vmlL2Yx/ipf8JYDu9fTBRLVxBJ5f98zUiqcPZCqXAj98vZXuDQkx	Get hash	malicious	Unknown	Browse
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/2143bba1-f463-ef11-a66d-6045bd003910/digitalassets/standaloneforms/3d28dcfa-8464-ef11-bfe2-0022480a9151&urlhash=OzMH&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse
	https://assets-usa.mkt.dynamics.com/c9f731e3-0864-ef11-a66d-6045bd003021/digitalassets/standaloneforms/0424cf3e-7364-ef11-bfe2-6045bd055762	Get hash	malicious	HTMLPhisher	Browse
	https://a.rs6.net/1/pc?ep=3883438d73e72a246foJjq_uXy7qjuphSr8GuJsgK6bkJfYDe6FntbUqbsxiBdzgPxR8Hx2QBLwhWsX_2B-jpMl08ribdVPIr28mdRJYSjtOFjYQymRiHOGfARsYbMGywkIEb_zjA2vsnLNnpUCH0rMUzs1r-HOaIbHYFF7fj1_dujsRYQUh6z8j1U07y8BkYxoKhUvGV5zch8lF&c=#info@cvb.uscourts.gov	Get hash	malicious	Unknown	Browse
	https://oh3y.ulvantiro.su/82xG/	Get hash	malicious	HTMLPhisher	Browse
	https://oh3y.ulvantiro.su/82xG/	Get hash	malicious	HTMLPhisher	Browse
	http://general72.s3-website.us-east-2.amazonaws.com	Get hash	malicious	Unknown	Browse
	https://imgsservices.ie/	Get hash	malicious	HTMLPhisher	Browse
	https://shoutout.wix.com/so/1cP6H1VAL/c?w=L7pua50bZIFuawn8wEC-GMcwrkjbzspUanxhOP-akj4.eyJ1IjoiaHR0cHM6Ly93aDEzNzExNjMuaXNwb3QuY2MvNzIzMl8zY1BGdU1LYlZDL0pnb0ZWUVluQWIvalN5TGg0eElzYy5odG1sIiwiciI6IjFjMDQ2OWExLTM4MjgtNGUwNy1iY2RiLWVjZDA0ZTM0NGUyMCIsIm0iOiJtYWlsIiwiYyI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9#em=katieidlewine0383@plopmail.com	Get hash	malicious	Phisher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://iv1tm.ykrbkt.ru/iV1TM/#hans.wurst@us.com	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
s-part-0032.t-0009.t-msedge.net	https://cb1cd44761364cecb21c459c42a86757.svc.dynamics.com/t/t/oIX7RshqCPFFtVxUphHklxDHFg31zySxgRv75vmlL2Yx/ipf8JYDu9fTBRLVxBJ5f98zUiqcPZCqXAj98vZXuDQkx	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/2143bba1-f463-ef11-a66d-6045bd003910/digitalassets/standaloneforms/3d28dcfa-8464-ef11-bfe2-0022480a9151&urlhash=OzMH&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://assets-usa.mkt.dynamics.com/c9f731e3-0864-ef11-a66d-6045bd003021/digitalassets/standaloneforms/0424cf3e-7364-ef11-bfe2-6045bd055762	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/da18b4d8-ef63-ef11-a66d-002248282d21/digitalassets/standaloneforms/c645fb5a-f963-ef11-bfe3-7c1e52023edb&urlhash=Dt1u&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://google.mg/url?hl=en&q=https://google.nr/url?q=Gl7qws6TcZ&rct=4214&sa=t&esrc=vax&source=Gl7qws6TcZ&cd=Nzpn8b&cad=Gl7qws6TcZD5&ved=Gl7qws6TcZ84214G&uact=82299&url=amp%2Fgoogle.com.pg/amp/cli.re/rp5Y1r#YW5kcmV3QGhlZWRkaWdpdGFsbWVkaWEuY29t%2F&opi=256371986142&usg=lxfGUQNysmkDx&source=gmail&ust=5108318229914681&usg=AOGl7qws6TcZjng81rOWFwZGl7qws6TcZqR81	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://bestlerdierholensie.bekomme-es.digital/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://zngw.officeinvoicedoc.com/DhpuI	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	r3Zor4OEe5.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	FSlXHyfGLJ.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
	x64_x32_installer__v4.0.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://cb1cd44761364cecb21c459c42a86757.svc.dynamics.com/t/t/oIX7RshqCPFFtVxUphHklxDHFg31zySxgRv75vmlL2Yx/ipf8JYDu9fTBRLVxBJ5f98zUiqcPZCqXAj98vZXuDQkx	Get hash	malicious	Unknown	Browse	104.16.76.142
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/2143bba1-f463-ef11-a66d-6045bd003910/digitalassets/standaloneforms/3d28dcfa-8464-ef11-bfe2-0022480a9151&urlhash=OzMH&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://assets-usa.mkt.dynamics.com/c9f731e3-0864-ef11-a66d-6045bd003021/digitalassets/standaloneforms/0424cf3e-7364-ef11-bfe2-6045bd055762	Get hash	malicious	HTMLPhisher	Browse	104.18.3.35
	https://oh3y.ulvantiro.su/82xG/	Get hash	malicious	HTMLPhisher	Browse	104.21.78.226
	https://oh3y.ulvantiro.su/82xG/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://imgsservices.ie/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://shoutout.wix.com/so/1cP6H1VAL/c?w=L7pua50bZIFuawn8wEC-GMcwrkjbzspUanxhOP-akj4.eyJ1IjoiaHR0cHM6Ly93aDEzNzExNjMuaXNwb3QuY2MvNzIzMl8zY1BGdU1LYlZDL0pnb0ZWUVluQWIvalN5TGg0eElzYy5odG1sIiwiciI6IjFjMDQ2OWExLTM4MjgtNGUwNy1iY2RiLWVjZDA0ZTM0NGUyMCIsIm0iOiJtYWlsIiwiYyI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9#em=katieidlewine0383@plopmail.com	Get hash	malicious	Phisher	Browse	104.21.61.175
CLOUDFLARENETUS	r3Zor4OEe5.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	FSlXHyfGLJ.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
	x64_x32_installer__v4.0.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://cb1cd44761364cecb21c459c42a86757.svc.dynamics.com/t/t/oIX7RshqCPFFtVxUphHklxDHFg31zySxgRv75vmlL2Yx/ipf8JYDu9fTBRLVxBJ5f98zUiqcPZCqXAj98vZXuDQkx	Get hash	malicious	Unknown	Browse	104.16.76.142
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/2143bba1-f463-ef11-a66d-6045bd003910/digitalassets/standaloneforms/3d28dcfa-8464-ef11-bfe2-0022480a9151&urlhash=OzMH&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://assets-usa.mkt.dynamics.com/c9f731e3-0864-ef11-a66d-6045bd003021/digitalassets/standaloneforms/0424cf3e-7364-ef11-bfe2-6045bd055762	Get hash	malicious	HTMLPhisher	Browse	104.18.3.35
	https://oh3y.ulvantiro.su/82xG/	Get hash	malicious	HTMLPhisher	Browse	104.21.78.226
	https://oh3y.ulvantiro.su/82xG/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://imgsservices.ie/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://shoutout.wix.com/so/1cP6H1VAL/c?w=L7pua50bZIFuawn8wEC-GMcwrkjbzspUanxhOP-akj4.eyJ1IjoiaHR0cHM6Ly93aDEzNzExNjMuaXNwb3QuY2MvNzIzMl8zY1BGdU1LYlZDL0pnb0ZWUVluQWIvalN5TGg0eElzYy5odG1sIiwiciI6IjFjMDQ2OWExLTM4MjgtNGUwNy1iY2RiLWVjZDA0ZTM0NGUyMCIsIm0iOiJtYWlsIiwiYyI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9#em=katieidlewine0383@plopmail.com	Get hash	malicious	Phisher	Browse	104.21.61.175
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://cb1cd44761364cecb21c459c42a86757.svc.dynamics.com/t/t/oIX7RshqCPFFtVxUphHklxDHFg31zySxgRv75vmlL2Yx/ipf8JYDu9fTBRLVxBJ5f98zUiqcPZCqXAj98vZXuDQkx	Get hash	malicious	Unknown	Browse	20.189.24.158
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/2143bba1-f463-ef11-a66d-6045bd003910/digitalassets/standaloneforms/3d28dcfa-8464-ef11-bfe2-0022480a9151&urlhash=OzMH&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse	52.146.76.30
	https://assets-usa.mkt.dynamics.com/c9f731e3-0864-ef11-a66d-6045bd003021/digitalassets/standaloneforms/0424cf3e-7364-ef11-bfe2-6045bd055762	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	20.75.60.91
	https://d4g6kw04.na1.hubspotlinks.com/Ctc/I9+113/d4G6KW04/VVDXvw2129f7W9lgpSl3-BQgwW4125np5kh8PvN1n_9Xx5kBl-W50kH_H6lZ3lBW5xCLbK6c416cW6G0HMx6QhV7VVrZqSG3HBKSjV6wDNg4ZyZn6W7_FTpm1dqZm4W723tVM4rftccW3vWlSp1wGvTJW2zXXwV1X740xN1t2gyvnMRlqW7JdFVP1Ty-FHN3Fp_ww3m7TdW66_q2r1Q3VwtW7Dpks077Qf8bM1V49whQ40NW6RphCp8kpt1HV_HZcV84HKmBW5lF7ZC61FD66W73XZV57GJ9ZkVDMN0b9hXGx2W8dysfm3qm-8VMZTWKPM6VCVW6l8ws98dhwKqW4Z2gzl8fZ601N7pH1zqJ5vZ5N90-353vPlZ7VD24xR8Rht6PVyTztF65g6ScN24XQrJRlvxMW20qlrM4TTNP7W6Lc5vQ43Pq7NW32bHwR84HFLgVgWx3d5S85nlf8gcVNq04	Get hash	malicious	Unknown	Browse	13.107.42.14
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/da18b4d8-ef63-ef11-a66d-002248282d21/digitalassets/standaloneforms/c645fb5a-f963-ef11-bfe3-7c1e52023edb&urlhash=Dt1u&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse	52.146.76.30
	file.exe	Get hash	malicious	Unknown	Browse	20.96.153.111
	401K Information.eml	Get hash	malicious	Unknown	Browse	51.116.246.106
	mbda-us.comAudiowav012.html	Get hash	malicious	HTMLPhisher	Browse	13.107.21.237
	file.exe	Get hash	malicious	Unknown	Browse	13.107.253.72

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://cb1cd44761364cecb21c459c42a86757.svc.dynamics.com/t/t/oIX7RshqCPFFtVxUphHklxDHFg31zySxgRv75vmlL2Yx/ipf8JYDu9fTBRLVxBJ5f98zUiqcPZCqXAj98vZXuDQkx	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/2143bba1-f463-ef11-a66d-6045bd003910/digitalassets/standaloneforms/3d28dcfa-8464-ef11-bfe2-0022480a9151&urlhash=OzMH&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	https://a.rs6.net/1/pc?ep=3883438d73e72a246foJjq_uXy7qjuphSr8GuJsgK6bkJfYDe6FntbUqbsxiBdzgPxR8Hx2QBLwhWsX_2B-jpMl08ribdVPIr28mdRJYSjtOFjYQymRiHOGfARsYbMGywkIEb_zjA2vsnLNnpUCH0rMUzs1r-HOaIbHYFF7fj1_dujsRYQUh6z8j1U07y8BkYxoKhUvGV5zch8lF&c=#info@cvb.uscourts.gov	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	https://oh3y.ulvantiro.su/82xG/	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	https://oh3y.ulvantiro.su/82xG/	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	http://general72.s3-website.us-east-2.amazonaws.com	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	https://imgsservices.ie/	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27
	https://shoutout.wix.com/so/1cP6H1VAL/c?w=L7pua50bZIFuawn8wEC-GMcwrkjbzspUanxhOP-akj4.eyJ1IjoiaHR0cHM6Ly93aDEzNzExNjMuaXNwb3QuY2MvNzIzMl8zY1BGdU1LYlZDL0pnb0ZWUVluQWIvalN5TGg0eElzYy5odG1sIiwiciI6IjFjMDQ2OWExLTM4MjgtNGUwNy1iY2RiLWVjZDA0ZTM0NGUyMCIsIm0iOiJtYWlsIiwiYyI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9#em=katieidlewine0383@plopmail.com	Get hash	malicious	Phisher	Browse	40.127.169.103 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/da18b4d8-ef63-ef11-a66d-002248282d21/digitalassets/standaloneforms/c645fb5a-f963-ef11-bfe3-7c1e52023edb&urlhash=Dt1u&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70529
Entropy (8bit):	6.0699254134826095
Encrypted:	false
SSDEEP:	1536:LMSzvKYqstVCgf8baMIl13555epSXsG8U03beXLLV6dzAOkfKUBpQXP6:LMS2dK/8bQl135repS8JD3qVpvBpQXS
MD5:	7321C6891CB568CE21DDFB010B122F24
SHA1:	C281B8896845124E2FBB6AF39369171916A3B7B9
SHA-256:	D8902099D48E390D19D7356B56C4D5C5146FF307D973BBF54B5D90A06B686938
SHA-512:	C1232D1508098E12D23FF2F4D262A92F211DF1A2F62DC91ECFB91A9A3E8BCCB5414CCC95CB2026C6C41E77E00E99B73B0FFB23FDF4E1CD35CE1EB9689FDACE85
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZB94cta8JqLbiF2zYWsrF0K38o0/KVgtVMF5aEI/vhxca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\130bb43a-a24d-4323-bcde-7fcdbfc34939.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2957
Entropy (8bit):	5.58095097964491
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afk72926DWLWwIkHB++drxYCvBevchRwmaJkXKRocVwlRmiB0:Xq8NkC1fkCFDW3bB3PvQvmwfJkNcixq
MD5:	A44D75F714F87D89A3663BC3310B469E
SHA1:	B21B83A955949BABA2200B153E97EA8FDBBDE08F
SHA-256:	21C86DA9D450FACD3075118181D4568E4B729F87352E139EEDB6F2CB547E4928
SHA-512:	CF0F3E6AF5D2F8A419A4FE1FD994BE77240A704479548305F6699F40606899A265CA0EF4BC167A67E3A0F159C590D44C2C83196CC4DDF60FACD4D3866FA5EFA8
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVMrVesw=="},"policy":{"last_statistics_update":"13369337461597006"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\24b45322-7dd4-4348-b37a-1c194b125813.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20793
Entropy (8bit):	6.065657988731845
Encrypted:	false
SSDEEP:	384:RtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaV8NBSNhU7n5N0SvcLnB1Mlt:LM7X2zt1jKYqHkZeM3S5N011Mr
MD5:	7813E209370F9D55039516E8404E2EA2
SHA1:	99CBD3169A7513AFB3014D82B84B7005A19F0AD8
SHA-256:	6FE2F880C08044D8F31C4D38BCC1875CD33B6A10FB93DF0BC6C2A5681222710C
SHA-512:	A2427DF06571024904A996B793B01421E1079CCBC63A94AF4A05B459C3AE46B81AEE7D0A08C5F25D5168DA1C319B866FF1CD0F6EC916A6F85FA30B0B12E0F0BF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZB94cta8JqLbiF2zYWsrF0K38o0/KVgtVMF5aEI/vhxca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3feeda1d-c3b4-4051-bafe-401522c30cd5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24096
Entropy (8bit):	6.052070754071584
Encrypted:	false
SSDEEP:	384:RtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaV8NlNhULIoqdFVEQVs8rSvcLnB1Mlt:LM7X2zt1jKYqHkZeMqZGQm8r11Mr
MD5:	278D4DD439A2AE61B3A1A3575C1AE3AE
SHA1:	80925E92BE4A67C1995D3EAFD52D492F7573D5DF
SHA-256:	9FC8A890CDC4428BBBBC6D36D4E9F032B9B55D03DDAA784919742A90151B0C6A
SHA-512:	3CC298FA57E02836071F33CFFAA5752CFE09ECA601F6C61429BDBB98A0FCCFAD1ACC32D4B0775C96046FFEA104B74D6DC1DF49C9FC7DD2F2E82620B802D8ED03
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZB94cta8JqLbiF2zYWsrF0K38o0/KVgtVMF5aEI/vhxca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\44c1f198-425b-4357-9489-2b1a30f5c19a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4234
Entropy (8bit):	5.491476993960786
Encrypted:	false
SSDEEP:	96:0q8NkGS1fkCFDW358rh/cI9URoDotoseB3PvQvlBeJkNc5SDS4S4SDSt7I4a:/8NBSifgeoDUyKlB6kNg
MD5:	6127C7A270AC6051A95AAF96F733435E
SHA1:	54B1E396485D95992060803A02C60A4A5C00902E
SHA-256:	B2AF98B4DA2211EC279E2A69B06070B516F79DC2825772E5F190913C05E02886
SHA-512:	EF57538952475EBA9B2DE0197D9EFF2C7C8BC0A5A791EE4DEF4026E21C590D50F42800CF7928CD1C014A964DC4B4F02FA3C7DBDE1CE0FE46394E54EC65CD71B0
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\864fafab-8440-4bd8-a46d-bac33cd5dd08.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20793
Entropy (8bit):	6.065658069062872
Encrypted:	false
SSDEEP:	384:RtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaV8NBSChU7n5N0SvcLnB1Mlt:LM7X2zt1jKYqHkZeMsS5N011Mr
MD5:	C5C39BE27D7ADBB0B7261CB4B94E62CF
SHA1:	C41443A5FF5CC939C39CFBED35943162DB09D134
SHA-256:	7B2E571B3E42CF604352047E2EAC6AA3AE3C964F0F08B119BD4A6F6A545EF2CB
SHA-512:	78896E30B7DCC2C3DC598EF9ECDF49574BF42E07D20D4AAE8AA80110DF6A09829FE02FE5B73BE864A13C4CD725630654055560300DEC8F406EAFEABEA280EE1D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZB94cta8JqLbiF2zYWsrF0K38o0/KVgtVMF5aEI/vhxca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\90faf154-dfd7-4afd-ac91-6075dc78cb49.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70490
Entropy (8bit):	6.069853820345431
Encrypted:	false
SSDEEP:	1536:LMSzvKYqstuCgf8baMIl13555epSXsG8U03beXLLV6dzAOkfKUBpQXP6:LMS2dKi8bQl135repS8JD3qVpvBpQXS
MD5:	21586AFC5C0BA7FC96B879C8B71BE821
SHA1:	8BF4D17909B7F378F2E460D412E729CAA9806374
SHA-256:	A8F7302FFC48145D4CDFF20CA730934FCE28CDD2CD8C08B8C4418E2C79AD6D9B
SHA-512:	3BACF3F6C216DDA7C3566CE0E8FE5EFB098B3326CF443B088D368A8763F9D9DA197FE031B424DBB1B83F7FB7FCD693C277A1A5BC0CA5D938354EBBA015BB2CB6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZB94cta8JqLbiF2zYWsrF0K38o0/KVgtVMF5aEI/vhxca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139867263744
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
MD5:	515BFDD0A8E03F491ED66894DAC7434B
SHA1:	00534E56EA194556D8E48772D2463BB291B567AC
SHA-256:	C76D8691C06568DE0108BAD3E4C5596E5B6DB4AF6864E0C4B57F3EE2C909FA18
SHA-512:	649D4F9FF7446C1DB4B16F6A4C9BEBF0A92A9E266898D653A11CBC44FCCDE8472D91758A624AA5D5A1B306DFA793E5F72370ED70514CB25312B76ACD605EA652
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\d48ce1cc-e8ec-44cb-b3fb-595df9a02242.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139867263744
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
MD5:	515BFDD0A8E03F491ED66894DAC7434B
SHA1:	00534E56EA194556D8E48772D2463BB291B567AC
SHA-256:	C76D8691C06568DE0108BAD3E4C5596E5B6DB4AF6864E0C4B57F3EE2C909FA18
SHA-512:	649D4F9FF7446C1DB4B16F6A4C9BEBF0A92A9E266898D653A11CBC44FCCDE8472D91758A624AA5D5A1B306DFA793E5F72370ED70514CB25312B76ACD605EA652
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66CF5575-16DC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.040496128507991024
Encrypted:	false
SSDEEP:	192:tmUjLYiVWK+ggCdl2JtD+FX9XAFokgV8v4MhlwNE1bKRQM9/nphn8y08Tcm2RGOD:MUjjl6qiG0haca9nph08T2RGOD
MD5:	2E7333B85781508892AA82130EF7B7DD
SHA1:	5210EFC6944CBB2D85C0FDB77E8DE7FF1DEDFFCE
SHA-256:	6B2AF439599284CD3B4BD2497637AB30EBD2C5FB92C0470E3A1FEB8D53603024
SHA-512:	6F7E90BDD5D8D1D93079D61B28A84C56282AACACB5A3BC8BE500B8D0D388DDDE7F4CF995AAFEC857B0B56975B83ABDC0EB4343B1700D7F2178A40A17FE113D69
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".tcbmkt20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............#..................!..$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....X9..~W@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66CF5576-448.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4488057090527756
Encrypted:	false
SSDEEP:	3072:Qw5VQat0HoNM+WAREY2qjOvdTftXF1d9nji3dg1HF972fwJcGeiOGMqI02Wfjk1H:2axCji3daHKnX2moD00KeaHTXbcs
MD5:	FA28AFA97D78322A6EFC5A9839FCDB78
SHA1:	2DE558922221639996E35FBDFC489DBFD72ABC28
SHA-256:	23332784F27C27CB76653586FBAA47B763C47F136505F5DCCE91764DD5BB64E4
SHA-512:	392F3AD5E9BA35F02205BE981A11BC45D4B45BD05FC4A896A7ECFA4C4807E01025C9FBB0623F8926355DCE1036925B49AD577DAB6DA0AAD35D8DAC566AF370C4
Malicious:	false
Preview:	...@..@...@.....C.].....@................3...3..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".tcbmkt20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.138620596913704
Encrypted:	false
SSDEEP:	3:FiWWltloXzX2eHSRqOFhJXI2EyBl+BVP/Sh/Jzv30DIjxDILhuuatl:o1u72eyRqsx+BVsJD30UNDcuuaX
MD5:	324B73566E5875E22057C5B0B2F0FF9F
SHA1:	E45DE7224CDBC769E49D8A99094F2E0B0688A244
SHA-256:	C6E17268987CCB00A889491334767CE21D621A21F71AA7A20E6C5410D2070B82
SHA-512:	D5F73696B71D439561BD4DE75939D1E4D91E10B5CE684A62507A0A0C6831F37097A6068E943D1ECE2179755BBC7EEEBBEDC968D268ED398038E37C1D151F8B83
Malicious:	false
Preview:	sdPC......................3H+U.C.V.I... "1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................89e492ff-a418-4bcf-a4b5-d1037f3fbb0e............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\261ebe91-24ce-4de8-b54b-df0e05e4f1e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.969502511262055
Encrypted:	false
SSDEEP:	96:stnqfNtis1qb9jBgN8z41s85eh6Cb7/x+6MhmuecmAe/6o2M5R/EJ:stnY0sWgNkMs88bV+FiAkP5RMJ
MD5:	766E3020B11B88B1CF41C0B55A08137F
SHA1:	E1B31092CC2B29293323996FCEC74287811DC9CF
SHA-256:	FFE515CEC218574C12D72FD7EA6F14A2147BD64927DAF22B0D7325D9A9C5BDC7
SHA-512:	5A222C1083A3EBBA1FCA6A246FED3BFCE6F777A21A9F898111312C8F6F0D61DE95066ECF621115E29C539375C3864A5D0ED614D8F0B105B49F79E63138C753AD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369337463050969","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369337463056860"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\6b30307d-acb6-4abb-9f8d-1426b41b9432.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565762028784811
Encrypted:	false
SSDEEP:	768:JjJEU3WPLLfI/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLKiDyrwueopGtug:JjJEU3WPLLfI/u1jaSbD3ueBtX
MD5:	DC77917B34B304FDF3F86E9569A1DC64
SHA1:	7F377ECC368320ED152EDFD2C592E2CB11E20B4D
SHA-256:	D963C4C019F847CF5CE7759166D96D6608D5E3C1519FD9BE3BAD1D9F45D2F43E
SHA-512:	2825BD9D2BFD3AA40558851E0AF264A9B974F65ED15079C7E973398FF8C828F64A79FE2DB9862CF5E56BBCF8D376523F4E5F3F21932715AD286DAD5061CBD945
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369337462380262","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369337462380262","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7529d1c5-64bf-4c9a-8ad1-1e15b21f3cc5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.565863274959489
Encrypted:	false
SSDEEP:	768:JjJEU3WPLLf7/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLKiDyrw9opGtuk:JjJEU3WPLLf7/u1jaSbD39Btz
MD5:	75216622B1E35DDC6C1E899005781A17
SHA1:	88B72B3C0DA43021C0AE579B3528CE0414C8DB88
SHA-256:	424B7A5E9172632018D592A3E39143098CFB3C2C865C281ABE368670DCF4B7FA
SHA-512:	4BE4B577BF7C8896E91D5BD45117BC30377F7013DC4F00F75029EB5A99DCBFF14050124C218E8C371510F8830B5F922659355B3A52EF5B9B1887879C0B9D89B0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369337462380262","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369337462380262","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7d2c65c3-22fd-4722-84bc-c9cd940f52d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6426
Entropy (8bit):	4.976377585492972
Encrypted:	false
SSDEEP:	96:stnqfNtis1qb9jBgN8z41s85eh6Cb7/x+6MhmuecmAe/0QL2M5R/EJ:stnY0sWgNkMs88bV+FiAGP5RMJ
MD5:	7135856972A691F5048EC5947FE7CA18
SHA1:	6BCBFB4B95FCA8A0AF1F97FEF6F04CF2D172E743
SHA-256:	3BC507D0DA953B8623CD55241AA7575264B8B2138B2A7E33D86F1E9C9A0110DB
SHA-512:	9A3CA2F9D15A8A881DD29BB69D43AD1E9E81216C517F587D352DD03FF580880660872AED11846705031B3367D017D704E06378FA97AEE14A9AD7829C7B5BEA79
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369337463050969","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369337463056860"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\824a1d5f-3ec1-455a-ad72-8078b059456b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321860851295999
Encrypted:	false
SSDEEP:	192:mAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:5OEOKSXs/J7mGnQmLu5/5eNdl
MD5:	176C9FC6D71ABA42E269CBB7BD6A8CBF
SHA1:	9C12115D9476EDB140D975AE495CEB85AC995759
SHA-256:	BA54D3062277EC036A67E3CE03F8EC44BA6C7B02E0DB1C7760B01F5835265CC0
SHA-512:	2CD27A438229C4CB792527F47BC5C46DFDD3A16CA33E73E35391AEED2994120272BAEAB5DA58A510BE64AE2563B150637EA68DD6D2AE4FCA42BBA5E4CD99C123
Malicious:	false
Preview:	...m.................DB_VERSION.1....................QUERY_TIMESTAMP:arbitration_priority_list4...13369337467630545.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.142776974546571
Encrypted:	false
SSDEEP:	6:NHBxL5M1923oH+TcwtOEh1ZB2KLlLHBxLW4q2P923oH+TcwtOEh1tIFUv:NH9hYebOEh1ZFL1Ha4v4YebOEh16FUv
MD5:	5026556587632158FCFD2D0BD630EADD
SHA1:	8458A6FD0B3E2C06890CF5582658823F1464B0A3
SHA-256:	67C3D8EDAD7BB13DA3B64B6298B0CC19D16FA15FE7E34759B3008BCE2357613C
SHA-512:	E9B1C7437238D70E8BAFDDA260F1F96B0186EB859CB4076C7D30BE8A33825D01483E27E691620BF75ECC9543D03B7661B1DAD9F86F3E253AFDD0D076014F6C5D
Malicious:	false
Preview:	2024/08/28-12:51:06.841 21c4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/28-12:51:06.937 21c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.04432299500216697
Encrypted:	false
SSDEEP:	6:/Fii2C0/UkM/lgabhAiRhKifPMtmSE/kllV8TaW//lM:dC9E5bh7h7PEmSD/E
MD5:	335482CB2E26E53B834A48B5D1FD81D0
SHA1:	F5C0549CAE4849D4876515EF72964FC62F2FCF6B
SHA-256:	6334909F92D49CA0747B9066718B6CE0096A93AE3EBE77D3024B73BD3514A4C1
SHA-512:	078FA62ACFFD3B7281A0D7606D170049683CBA3958D13CD738D2B8140315962AE8FE9693706C9745131953B7E3E55F5DC7AE35D9765DDA82054DB237774B75A2
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09559194885059755
Encrypted:	false
SSDEEP:	48:1KiV4A3esJvV4XesrAMo6NUeGwE0lT3lWp4:1bV4A335V4X3rAF6NLGdI3L
MD5:	0EF23A558D237C588316C243F7549B5D
SHA1:	DEDB8A615A553BA720ED3296920A91C68ADDCF6C
SHA-256:	64ADEA5E662039A267DA3D2CB50AF2DEF468E7F56686CA2AF3BAFF9727998647
SHA-512:	654EFE7A135AAF76E11DDEF680BB34646F84B295583F956430CEABF1433C89BB6D2E3F8FAE32BD7AAEF335DC87647F5B9703173738A8544071ABE4DAECFF0ED1
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.28328961201667413
Encrypted:	false
SSDEEP:	192:o/xERRynnJZbtMXH4/xERRynnJZbtMXa/PIJR9cBkJZbtM4e/GdR9cBkJZbtM4A6:6LJJtMHKLJJtMGx6JtbE6JtbcxdJtP
MD5:	BB3AE395AE311979CC2103F4BA74AB62
SHA1:	8EF14F58CA16A337C9D4C8D34147D07CFBA54D8D
SHA-256:	A689153AEE82F625F316FC900DD54919DBA8C7F25F0CA19AA4A439B49BE3D4DE
SHA-512:	D7E0CA145BF4202924FAD4870EC34E38CA8D70BE6CC5A32737C446700537019C08753CD1A44EE218D58BAFFBEE1772CCA0167B1452093568BBFDDD0395EB4F40
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsul3a/:LsJ/
MD5:	9765AABBCE0D69B5970C40A32B1F3EB5
SHA1:	440141218052C3BFB03B9D6CC15743E9C103E857
SHA-256:	503FCEF7F202BEDA0E1576C021AE7DCBB3DBEC3E574920969FC25EE01B0A7F41
SHA-512:	21E58E3D2FFAC224A055E17EE6F2BB9F9315E7CA00A9C996D5DD9DAEBEA6717B65CF6081149C335E24EB51013F017D0D09B2E473D85CC944BE36B14FB3B5DCD8
Malicious:	false
Preview:	..........................................urW./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9138909867280645
Encrypted:	false
SSDEEP:	3:Qt0EhPn:QZhPn
MD5:	A6DDEBDAEDD57B1B79FBF94E67BF9259
SHA1:	DCC5784ABAE71BD47E7C6E72421A123568216211
SHA-256:	E2402E7EA8CEA9586A7A8C260275A900EEE8108098019EDEAA3D850157659868
SHA-512:	A1A7A16D243327CFD5AE9BF1F684E04103E08D3737CD77BF1E225555AFEC8C57A6C10A86D1546A30FABED27670339401C8FE61C0E7A380E8832683A2FAB07703
Malicious:	false
Preview:	(...M..4oy retne........................=.WrW./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9138909867280645
Encrypted:	false
SSDEEP:	3:Qt0EhPn:QZhPn
MD5:	A6DDEBDAEDD57B1B79FBF94E67BF9259
SHA1:	DCC5784ABAE71BD47E7C6E72421A123568216211
SHA-256:	E2402E7EA8CEA9586A7A8C260275A900EEE8108098019EDEAA3D850157659868
SHA-512:	A1A7A16D243327CFD5AE9BF1F684E04103E08D3737CD77BF1E225555AFEC8C57A6C10A86D1546A30FABED27670339401C8FE61C0E7A380E8832683A2FAB07703
Malicious:	false
Preview:	(...M..4oy retne........................=.WrW./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9555576533947305
Encrypted:	false
SSDEEP:	3:Q+icyyEQR7Eln:Q+/qE4
MD5:	A8C2D16CEF1EEF2185E9559312E266B1
SHA1:	595E3A03B79559FD9BBD462BE2106F7DB1EDCE73
SHA-256:	08CB2A6056DB9F48B1F5D855624A3B9174C74D238E34929B52F65C2D72AECE58
SHA-512:	4BE5F5C4941D371E4E300CD89317C45512324EE5A3718A219F21B07FBB9DD18D144B05EBFCB69EA1D8491C56C6F777A94A162F0AC609FF1D6620C44DD139C6CB
Malicious:	false
Preview:	(....;.:oy retne.........................4VrW./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9555576533947305
Encrypted:	false
SSDEEP:	3:Q+icyyEQR7Eln:Q+/qE4
MD5:	A8C2D16CEF1EEF2185E9559312E266B1
SHA1:	595E3A03B79559FD9BBD462BE2106F7DB1EDCE73
SHA-256:	08CB2A6056DB9F48B1F5D855624A3B9174C74D238E34929B52F65C2D72AECE58
SHA-512:	4BE5F5C4941D371E4E300CD89317C45512324EE5A3718A219F21B07FBB9DD18D144B05EBFCB69EA1D8491C56C6F777A94A162F0AC609FF1D6620C44DD139C6CB
Malicious:	false
Preview:	(....;.:oy retne.........................4VrW./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlzzaKlt:Ls3xlt
MD5:	E55B20EDBEE0193344424670AA6DA1FC
SHA1:	40CB8038B683F26B47BBD92536ACEF4BFC6BB1FB
SHA-256:	DA726C2E15880311609896F0DF3471B0203C52177118D8E421932A00D4B35361
SHA-512:	2F4C9D2FD5FDD011AF739DE5714F70F0B9C93CF604FA9539F530F768E254EB0C0862C377937E460BA4E7055707C25F25257D5CD8598B881D49DF38288F2D653A
Malicious:	false
Preview:	..........................................orW./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354177351319679
Encrypted:	false
SSDEEP:	6144:kA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:kFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	D71CB77B73D6B960F6E89051BD794DFD
SHA1:	A3919DFE38ED454BE516A51AD45A622BF1841235
SHA-256:	B053E444DC38451D185B61A57AE3A3D6B28713680B5E7ACC565BB1FA71344082
SHA-512:	23DB5C3372A47E3186125241775A68E0BF557AC81C0F3FC84BC91E725CF3ECA067D1218DB3697AC7D9780871B8E4851F77F8217B534DF160A10E29217555620C
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13369337467686759..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.198723652489118
Encrypted:	false
SSDEEP:	6:NHBxLWUARF+RM1923oH+Tcwtj2WwnvB2KLlLHBxLvt2q2P923oH+Tcwtj2WwnvIg:NHYRFuhYebjxwnvFL1H7t2v4Yebjxwnp
MD5:	B7DFC675F463128B7B5033C03B6CE2BF
SHA1:	B10819446B1402F9CFDFB40896E528737DC406DD
SHA-256:	48E6A6A670E805F436BA9DEA31C184728E55751990A98D1E2C8D7E7E74906879
SHA-512:	0C669CF03797A7BBB514402E19C5786CC57BDA104A15DE4172C7BCA9F7D98DA04CD919C99AF9E7DC5FA6D81A5ADEE863D48B52887531630211272F537A61ABC9
Malicious:	false
Preview:	2024/08/28-12:51:06.852 21e4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/28-12:51:06.976 21e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.324611453738646
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RJ:C1gAg1zfvx
MD5:	011604A9F83B2D168D637B578F024D22
SHA1:	63AB08D2DF3C7B8B9BD0EE69F634D22C87CE61DB
SHA-256:	913DDA3A275D6B6929818F2A0746F2639757438B92780FC2CB82CEE32A3BCF15
SHA-512:	1619DCAFCB8F0EE332FACC976ABB5ACDF1D6FE35D0273B83D6CCDCDE3BB9F4038267932CB2200F1E11B19E4F5C9F1E4BFB3D9538645CAFEB781AA7CA7462D3C8
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.153159557937203
Encrypted:	false
SSDEEP:	6:NHB1La1m81923oH+TcwttaVdg2KLlLHB1LmQuxyq2P923oH+TcwttaPrqIFUv:NH61mxYebDL1HGav4Yeb83FUv
MD5:	5D644E1DE71DEAFBA3574F27E4DDF5C1
SHA1:	491034FF69D75506CAC037AD23DC8F003199F4C0
SHA-256:	A3BB2BC8925A7662A0D351FE69901883AC5303B9F9512580391D1C0999637B57
SHA-512:	190C075349708B6986CC826426AFA0E6C0D6970FE9E1B10DC7EF0B764CBB7BE1FBBA86706B1D3755268EDFE3EE2AF8987C2DE944F669713BFDD73ABEF0AD0ADE
Malicious:	false
Preview:	2024/08/28-12:51:02.389 1ca0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/28-12:51:02.705 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.147775709846977
Encrypted:	false
SSDEEP:	6:NHB1Lma7m81923oH+Tcwtt6FB2KLlLHB1LX9yq2P923oH+Tcwtt65IFUv:NHGaixYeb8FFL1H3Av4Yeb8WFUv
MD5:	1D5AE273859D93C66141E3CCF5BCC298
SHA1:	A983CBE4911F7C92C4C67596AB91BEB31046F246
SHA-256:	1831FAD89D8719E9335DFC6DE7E05F58CD7342DB0B1E7B7A1337C1B1D2117A2F
SHA-512:	7416EF0F226D06ECDE73609A1C5904AD9927909DC385981C072E86C7DBE092380372CCC8DCAAAB62E284116ED2AEDD88EE788874FCB5B273E6939D543211707A
Malicious:	false
Preview:	2024/08/28-12:51:02.706 1ca0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/28-12:51:02.735 1ca0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.150172115960993
Encrypted:	false
SSDEEP:	6:NHBzL1FD1923oH+TcwttYg2KLlLHBzLkYL+q2P923oH+TcwttNIFUv:NHVL1FmYebJL1HVLkdv4Yeb0FUv
MD5:	7FD53AE4E1CFB1BF14C7E3942E33604B
SHA1:	2B9D428E2C345298F8AAD4C12BA0E06167712E40
SHA-256:	C01C68F73DE073A932C77F470883FAD2B4BBEE68E11B6B2D9B55EAFA707CB840
SHA-512:	125A1AB146B8042EC4653A8F4C21D45A6C37C7BC3059138F5D503FB404F00B6D5C3FE744A0794CED93DE22C40B716E1542A1EE47F16B1D44795CDEBD1B15E255
Malicious:	false
Preview:	2024/08/28-12:51:04.151 1c98 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/28-12:51:04.162 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlJjya+l/:Ls3Ap/
MD5:	3682E5A5F2B624C82F17AD3B4DF8D0FA
SHA1:	A83D8BFCCE9F25591ED94E2D5CE11DECC1614BC3
SHA-256:	649078A569BBB411EAF04C0BF82A1D9D7F7CFCDB5BD31161B488DCEA608B54D1
SHA-512:	BE3B375B8DE89A5B2757C901B3E64165D9481A6B564012AA46A75755F5999C15DA3BAEC9DAB5E4ED71CD383BB90B4ED5E12C5677C4E9BD9A8FBB5FA904FDAB82
Malicious:	false
Preview:	..........................................nrW./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21838546206064957
Encrypted:	false
SSDEEP:	3:NtFlljq7A/mhWJFuQ3yy7IOWUb0BdweytllrE9SFcTp4AGbNCV9RUI3nY:W75fOx0Bd0Xi99pEYlnY
MD5:	960AE77AA51AC479B57279753D89A563
SHA1:	9CC60CC7D270D4DDB136321DB2A642E1319E31FE
SHA-256:	D67F8720CB3B61F5AB2632AD2B827A136DE5B7E69E9DFF48A875601A882DE1CC
SHA-512:	D18B15425D6AE987DD167495B0C039D11687D1EE0CB57E910D798D3CE5EA361E06063FFC0564A00C4EA860FB40EC7A76E8DD327F0C190AEFE53822373C453062
Malicious:	false
Preview:	............>Q.}...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	379
Entropy (8bit):	5.22014064046854
Encrypted:	false
SSDEEP:	6:NHBQXGRG3B1923oH+TcwtRage8Y55HEZzXELIx2KLlLHBS9+q2P923oH+TcwtRai:NHkGG3MYebRrcHEZrEkVL1HM9+v4YebV
MD5:	19DB1EABF8B7AF78D14612023478A3D1
SHA1:	361CD3CC7755E7D3C0F007AE0CC0A835B59B31C4
SHA-256:	4C4BCF0903186014187A4731831148C4F4C1CCE1E4141E2923C3A47E3ADB03D2
SHA-512:	903472383953824F296EEBF88A86D0ABEC137D3565A16F399BD9C76C54C740EA35CE1E44A8BE251E8BF9275DC86BA6CE2094ECE7926037AAC0F25248AC311E1B
Malicious:	false
Preview:	2024/08/28-12:51:05.083 1c4c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/28-12:51:05.096 1c4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.205827799912971
Encrypted:	false
SSDEEP:	6:NHBEkos1923oH+TcwtRa2jM8B2KLlLHBAq2P923oH+TcwtRa2jMGIFUv:NHa5YebRjFL1H6v4YebREFUv
MD5:	D0FD33DFD95A5DB470C6E23C8A1C95FE
SHA1:	6598DB4C22DB37FB558F9E7F0CB1F226DCF21027
SHA-256:	4CDAEDAB06977C8B3E4817237B133D082233693AEAA7899E2FD59EDC67F0D2E0
SHA-512:	85B8422E899B7BA749FBEDDD4DE1E872A279767848043C94175F9793153BD0B53D59D9ADD88C48E9110CDD5A0D81B911530C4D23C1DEDDC69076567ECF2BA561
Malicious:	false
Preview:	2024/08/28-12:51:03.762 1d70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/28-12:51:03.784 1d70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\1838b69d-5de9-4053-9bdb-7bfe87af3fa3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\1f6f7cd3-87e5-408e-8f3d-e596852368ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF456e6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7601858291667791
Encrypted:	false
SSDEEP:	48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBk6r:eIEumQv8m1ccnvS6OI
MD5:	7BDA00BEDBB73D6AF90F7C5071E38409
SHA1:	D418D70D527C32BEACCDFC8FCB428243A513594F
SHA-256:	87E265E805F52AFC2EDDFBA7335ADDEBD53602DD7D305DAFDAAE637CD4B1C57E
SHA-512:	5A3FF7DBDCE35AB0C75AC5F3A28F4E6910C1165B42824C866266DFC17160E1A9608D8F5D74A4499F89FE57C0D4D2998023BC998AA10057F422A851911B188C5D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF335a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\c1c6de2e-5cc8-40ba-b1fb-7de6e24d5599.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\e4c24dd8-ccd6-495f-8766-ab93c41a8ae2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\e5a26578-df99-457d-9d3a-a3ed75cb49dd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.969502511262055
Encrypted:	false
SSDEEP:	96:stnqfNtis1qb9jBgN8z41s85eh6Cb7/x+6MhmuecmAe/6o2M5R/EJ:stnY0sWgNkMs88bV+FiAkP5RMJ
MD5:	766E3020B11B88B1CF41C0B55A08137F
SHA1:	E1B31092CC2B29293323996FCEC74287811DC9CF
SHA-256:	FFE515CEC218574C12D72FD7EA6F14A2147BD64927DAF22B0D7325D9A9C5BDC7
SHA-512:	5A222C1083A3EBBA1FCA6A246FED3BFCE6F777A21A9F898111312C8F6F0D61DE95066ECF621115E29C539375C3864A5D0ED614D8F0B105B49F79E63138C753AD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369337463050969","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369337463056860"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF3c5b2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.969502511262055
Encrypted:	false
SSDEEP:	96:stnqfNtis1qb9jBgN8z41s85eh6Cb7/x+6MhmuecmAe/6o2M5R/EJ:stnY0sWgNkMs88bV+FiAkP5RMJ
MD5:	766E3020B11B88B1CF41C0B55A08137F
SHA1:	E1B31092CC2B29293323996FCEC74287811DC9CF
SHA-256:	FFE515CEC218574C12D72FD7EA6F14A2147BD64927DAF22B0D7325D9A9C5BDC7
SHA-512:	5A222C1083A3EBBA1FCA6A246FED3BFCE6F777A21A9F898111312C8F6F0D61DE95066ECF621115E29C539375C3864A5D0ED614D8F0B105B49F79E63138C753AD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369337463050969","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369337463056860"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF43ac3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.969502511262055
Encrypted:	false
SSDEEP:	96:stnqfNtis1qb9jBgN8z41s85eh6Cb7/x+6MhmuecmAe/6o2M5R/EJ:stnY0sWgNkMs88bV+FiAkP5RMJ
MD5:	766E3020B11B88B1CF41C0B55A08137F
SHA1:	E1B31092CC2B29293323996FCEC74287811DC9CF
SHA-256:	FFE515CEC218574C12D72FD7EA6F14A2147BD64927DAF22B0D7325D9A9C5BDC7
SHA-512:	5A222C1083A3EBBA1FCA6A246FED3BFCE6F777A21A9F898111312C8F6F0D61DE95066ECF621115E29C539375C3864A5D0ED614D8F0B105B49F79E63138C753AD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369337463050969","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369337463056860"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565762028784811
Encrypted:	false
SSDEEP:	768:JjJEU3WPLLfI/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLKiDyrwueopGtug:JjJEU3WPLLfI/u1jaSbD3ueBtX
MD5:	DC77917B34B304FDF3F86E9569A1DC64
SHA1:	7F377ECC368320ED152EDFD2C592E2CB11E20B4D
SHA-256:	D963C4C019F847CF5CE7759166D96D6608D5E3C1519FD9BE3BAD1D9F45D2F43E
SHA-512:	2825BD9D2BFD3AA40558851E0AF264A9B974F65ED15079C7E973398FF8C828F64A79FE2DB9862CF5E56BBCF8D376523F4E5F3F21932715AD286DAD5061CBD945
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369337462380262","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369337462380262","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF3954c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565762028784811
Encrypted:	false
SSDEEP:	768:JjJEU3WPLLfI/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLKiDyrwueopGtug:JjJEU3WPLLfI/u1jaSbD3ueBtX
MD5:	DC77917B34B304FDF3F86E9569A1DC64
SHA1:	7F377ECC368320ED152EDFD2C592E2CB11E20B4D
SHA-256:	D963C4C019F847CF5CE7759166D96D6608D5E3C1519FD9BE3BAD1D9F45D2F43E
SHA-512:	2825BD9D2BFD3AA40558851E0AF264A9B974F65ED15079C7E973398FF8C828F64A79FE2DB9862CF5E56BBCF8D376523F4E5F3F21932715AD286DAD5061CBD945
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369337462380262","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369337462380262","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.125394715275021
Encrypted:	false
SSDEEP:	6:NHBzgs1923oH+TcwtSQM72KLlLHBdh/Aq2P923oH+TcwtSQMxIFUv:NHEYeb0L1Hev4YebrFUv
MD5:	A5996C705FD2BC0D7309B4B2C964490A
SHA1:	EE4DD1E615358603B5210D197094A16D654A0E09
SHA-256:	A176D7CC0477917D004838BC96AAF54E4AEC4D517960272563B057BD2270A0AB
SHA-512:	CA30C04548905A1FBFB9ED08640A8384371B579D484101AC3701D04750679BFE81D11142B158565EDB64BA77E2BACC4CE5BCAF686D5BE920A4325BAD1D23D4ED
Malicious:	false
Preview:	2024/08/28-12:51:19.958 1d70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/28-12:51:20.002 1d70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.073952777072458
Encrypted:	false
SSDEEP:	6:NHB1LTV+q1923oH+TcwtgUh2gr52KLlLHB1LvVN+q2P923oH+TcwtgUh2ghZIFUv:NHR+fYeb3hHJL1HPVIv4Yeb3hHh2FUv
MD5:	62E2D9BDC5660697C276A5F6F3D71AA9
SHA1:	E7D47B6A7D87E5A228B6BBC056ECE1AA910617AA
SHA-256:	208F5BB62112BD535059DA152ACD9C6FC415AF400A0A0542EEF3A2BBDEDF6115
SHA-512:	EC5CC14176C8C5332C256629B8FAFDA5C3A1ED6DD6925BBDDB93255B746B7048E0A278A6860B240DFF6A3087C9137C28119D222AE9D61F78835D01FC67435FDA
Malicious:	false
Preview:	2024/08/28-12:51:02.602 1c88 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/28-12:51:02.710 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulRkJq:LsM
MD5:	7ADBC64FEE06122210A6D26926A4AE7E
SHA1:	CA3719EFE5E3E0923A95DEE1C03591955CB57B50
SHA-256:	CE49E4E01AD76DE5643EF07205CFE04EEB2D7B183838248FFDBBD4D7DD35E051
SHA-512:	9810488A879BFDDAEF8D55BCBCF80F5B16FEFD2F678D9EE4FEFEDD2E020D8472331AAEA7088168B7FF35E5AE576F061F0A76D63CD4F9E905703E45E2971E406E
Malicious:	false
Preview:	........................................q..rW./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.913890986728064
Encrypted:	false
SSDEEP:	3:JEK0XAR0EqVKXya+:IguKXya+
MD5:	84AB9C87A724129F3F2C7A9483C18D99
SHA1:	03584630CFA5258F1E9F6577C66E0AE7A2910C62
SHA-256:	6CC88940F4D30CDC635444F0F1321D04FD07A60B2C9889BE1C4B8EB4C3B3BCF5
SHA-512:	51018414DFF8346C75F65EE2F2E3246C9F72D3DB656AD2CA71B527B8084E155BE880358C1389B0C47FF52DC79B8B6A3FB45C01593A9F151F513CDFE1D3A7113F
Malicious:	false
Preview:	(......oy retne.........................0orW./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.913890986728064
Encrypted:	false
SSDEEP:	3:JEK0XAR0EqVKXya+:IguKXya+
MD5:	84AB9C87A724129F3F2C7A9483C18D99
SHA1:	03584630CFA5258F1E9F6577C66E0AE7A2910C62
SHA-256:	6CC88940F4D30CDC635444F0F1321D04FD07A60B2C9889BE1C4B8EB4C3B3BCF5
SHA-512:	51018414DFF8346C75F65EE2F2E3246C9F72D3DB656AD2CA71B527B8084E155BE880358C1389B0C47FF52DC79B8B6A3FB45C01593A9F151F513CDFE1D3A7113F
Malicious:	false
Preview:	(......oy retne.........................0orW./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.856497497099659
Encrypted:	false
SSDEEP:	3:mNdEFnEln:mNKFnM
MD5:	5BE81C4FC991AB2C5E11C576CA5917A5
SHA1:	35867A32BE2B8ACCF0B876D3EBFC05DD6A791793
SHA-256:	58CC7140C7D8F7FBBFB90A5B961085E66BB297EE9641B07407625D7BE3B66771
SHA-512:	ADA5712599A6690D9DB845A5E0E2F3B41683A7608B3B19F60563308B0271AF62EE331C62D9BE4C2B6147D268271A23A19912876A6F249DDECC19995F437543D5
Malicious:	false
Preview:	(...{(1.oy retne........................Y"rrW./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.856497497099659
Encrypted:	false
SSDEEP:	3:mNdEFnEln:mNKFnM
MD5:	5BE81C4FC991AB2C5E11C576CA5917A5
SHA1:	35867A32BE2B8ACCF0B876D3EBFC05DD6A791793
SHA-256:	58CC7140C7D8F7FBBFB90A5B961085E66BB297EE9641B07407625D7BE3B66771
SHA-512:	ADA5712599A6690D9DB845A5E0E2F3B41683A7608B3B19F60563308B0271AF62EE331C62D9BE4C2B6147D268271A23A19912876A6F249DDECC19995F437543D5
Malicious:	false
Preview:	(...{(1.oy retne........................Y"rrW./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlPxJq:Ls35Jq
MD5:	A12A62D85D626826A2DD48B498086F2E
SHA1:	E588D0247AEE992CB8F3F8AD660CA2A4D64D0997
SHA-256:	A49BD714C8795591ADC36445455817D85ADF345BBB85F362DDDCEFEC68C04CCE
SHA-512:	30F9835BFC1448B6C64A138B1523B07CE7F00E4271FC2259C7DEF3771238E951A426EDF23FF13ED85EE1130C2AEC20B9526891283BC6BF1D7557287A5A049066
Malicious:	false
Preview:	..........................................trW./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlsUX:Ls3sU
MD5:	59D57D34DA66A0838D66A9C0215DD5F4
SHA1:	35AACF800ACE8D999ADB8086427104BCCDEA33C0
SHA-256:	8FF0BA77548A3D71522486D66AF7D8ABD487D06AA03494632EC2E6859A9583C1
SHA-512:	B9E146A607F962B6AC7C6AEB1DC54D0A844A4E240AD71427440C53E60F1FD990580794C9693BA7AC6DF976CB2B835AEC08718A596D6BC2A4906D5F644D55C07F
Malicious:	false
Preview:	..........................................qrW./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.19651738406129
Encrypted:	false
SSDEEP:	12:NHVLEzYebqqBvFL1HVLAwv4YebqqBQFUv:NCzYebq8L1d4YebqZ2
MD5:	A2D81ECFABD7CD0CCE2D23F9446728B7
SHA1:	391AE51D4CB47ECB6513A215BC9617C5EF46BD07
SHA-256:	84F285381CD8854B96759A9DB8A38F3CED86D84A14F71AF280FF6CA02A13FF4C
SHA-512:	1CE4F773ABDFC801FC3FFD8C3FEF19C230261F2604D19552DB053AD00F67335A441E6BDB478564B926D3C76959304D539CBDF49CB8E8504E1DF879552330F890
Malicious:	false
Preview:	2024/08/28-12:51:04.219 1d70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/28-12:51:04.250 1d70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\16b30a8c-fc85-484e-969b-bfc879849321.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\70aac095-9f39-4468-a90c-074073054aa9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\729e3ae3-4372-4673-85d7-0deaf686d87a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF45734.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a2b7f3fa-173a-4eed-95f8-0dbce96624ec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	393
Entropy (8bit):	5.178098511855832
Encrypted:	false
SSDEEP:	6:NHBdhUd6q1923oH+Tcwt0jqEKj0QM72KLlLHBdTkjyq2P923oH+Tcwt0jqEKj0Qe:NHaiYebqqB6L1H0jyv4YebqqBZFUv
MD5:	AB395BD12A6666C074C57115DAE1E204
SHA1:	EB24B86D1899F038352CF4EAED023781FFCF399D
SHA-256:	0461EDB262614EC438C72C1D6144FB39DF0BA06FF447E5A37E42B093A9FDB5A3
SHA-512:	6D81A1E42EECA6A4FE00481574FD5D8737A5DBE00D56B2A056DFA621C8DF3A973EF33BDCFF1C8F13CAFB198A7FE809A64F8D9BF56F72E36EC75DFBB38FA44583
Malicious:	false
Preview:	2024/08/28-12:51:20.018 1d90 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/28-12:51:20.593 1d90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.188707196390391
Encrypted:	false
SSDEEP:	6:NHB1Las1923oH+Tcwtkx2KLlLHB1LRVM+q2P923oH+TcwtCIFUv:NH4YebkVL1HxVM+v4YebLFUv
MD5:	4A5593978558122C92FB7F1E084BF90A
SHA1:	F5ABF0E17B097D4E33558A853B374EA50BC3CF0F
SHA-256:	18D410FD345E57532EB1DACC457F2025D3A954DCDBE2BC879A20B1D5143F96A4
SHA-512:	067DDCD285FA7DC79A14503467DC616C008ABA28533C0A8DE0493D47D255555DA73FD1E1BA8BDFFC363462DECF52DD7B90C46627024D8859B8269294345AE1E9
Malicious:	false
Preview:	2024/08/28-12:51:02.377 1c8c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/28-12:51:02.408 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtV2qUtl:IiV2
MD5:	EACEC16A5F69BC8E950F553B95DD933A
SHA1:	C74B2D28FA0E8FFAA593979A58AAE15BBE1858DE
SHA-256:	EE1BA65F78F816880852905D871D4007E4C88D1813D6C949453C9CA812760CF3
SHA-512:	C55AB1F988C33946680D6805E4AE9A6B37228A442A4E84CBF53951B8EF8DA88FA12E40100E40F34C860BDF03420CA0C744342C0E5D9B89132B5ECC9681184E43
Malicious:	false
Preview:	VLnk.....?.......8......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0769014617868817
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkO3SAE+WslKOMq+vVumYMvn66:e/2qOB1nxCkO3SAELyKOMq+vVum3p
MD5:	BF05F188E23A3E35C05481938EEE10C7
SHA1:	CE08099EAF87F361573A11FABA9952179E80A0EA
SHA-256:	6BFCB8E4B0468DD4C22B1CF59595D4CA7A8ED54E486A719444F891490F54027E
SHA-512:	9E850A26CFE58D7EF366802F35031FB240EF2ECE940937A71AC9ADC0E2C9CF08BD02E720DBA523705041AB858FB83B519D1BB441E64EA8D9FB685CB086BFC7A0
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\b39e9852-7c90-416c-bc97-47f3624fbb4e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\e3de871e-88f1-4332-942d-61b991accf1e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	4.978313970876574
Encrypted:	false
SSDEEP:	96:stnqfNtis1qb9jBgN8z41s85eh6Cb7/x+6MhmuecmAe/4QL2M5R/EJ:stnY0sWgNkMs88bV+FiAqP5RMJ
MD5:	41D97539A0B99DC822B7F01260058AE8
SHA1:	349148AD3206A85F7B9C4D0D6DF1F43A28CB1AF2
SHA-256:	87A1C5E2FC415901A1F5CB6251EC51AB57B6F39D73BA7C17938C121C29EBF8D4
SHA-512:	2E92FF19F72188161F3686D5E7D181E131FB140D421996FAD99D7EEFE4A8E23593D4F1940036FF8D464D601168B0EBBD4116E5335CA353A223758EB1A23E39D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369337463050969","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369337463056860"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28109187076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/AJnlXFlFll:7+/l/A
MD5:	173CDE5F0B09022A5AF47204520B64DC
SHA1:	E1F579E233730172422A6439BC4DEAD58A4F44F9
SHA-256:	A41B020131782B43EA9AE514F9FE9431087AE263994BF9CBE7C76358AFC12189
SHA-512:	EE0153D1C9255014F867BC08211DD14A65AA0F2CF39AB22D712B4C1ABC97E9EDA9F6753AE8BFC1E3F6DA036BB03E8E67F16AE2ABE4EA9FD0B6168B6D99110048
Malicious:	false
Preview:	.... .c......A..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04954173790060983
Encrypted:	false
SSDEEP:	6:GLW0MLW0RML9X8hslotGLNl0ml/XoQDeX:aYR4GEjVl/XoQ
MD5:	9DFC47F7FEFD800D59534258EA61B3D8
SHA1:	DDC962AAAC3A730052CF64E9246FBB37498801E5
SHA-256:	D6E46ABF73DBEFCACDC5F816CBF4564B221162AFCBDB713A108FFFBE5CB7DE94
SHA-512:	BE409EF946374417CB98B32B14AC9C760D1AD7456B7B31DB3AB74D9B2CDA8CFC0595C9F08CCC81E466BC717E647F9A6F724F5AEB9DD09255F1019ECA4F83B386
Malicious:	false
Preview:	..-.........................../m=.g....}......-.........................../m=.g....}............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9978344553345148
Encrypted:	false
SSDEEP:	48:ezxklO+ggcbX+Dn9VAKAFXX+N2VAKAFXX+fH2yxOqVAKAFXX+B8nUYVAKAFXX+KT:WxILINsLNstO5Ns9Nsaj
MD5:	3B3364A5E6DBAFE4DDE8525F4031D359
SHA1:	C1C6D8A494803090923EFF4A9464AB11F3433D0A
SHA-256:	EAAB8A837E8CFB254B667B1A2BEA5C8FD1402D7CA78DC96DB76BC21C290B78B5
SHA-512:	31217CDFCB7CB50FDE9C3A9A0BDF40F96BF6354F36A1C94C4A7312CD66C4DA7631C2E384D696976B7A29CF50EFE7EC6B5D9653E409BACFD0E228CA209384329D
Malicious:	false
Preview:	7....-..........m=.g...<.@..p.$........m=.g...X.o...fSQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.488185607178118
Encrypted:	false
SSDEEP:	48:ge87SBS2QrPyHRHAx2IYjIYczMqktMYjMY5yjAlkfAlkh3:h02QuIYjIYczMbtMYjMYYYcYM3
MD5:	08440BF37CBD3DDB4904BA0FB5E74DBE
SHA1:	7011CC5B5C4173D114767EE04A87DD02B1A80CCF
SHA-256:	90F945C345A219BC95EC09DE909AA0AFC70059DE420F028E0552ADA5A0334C83
SHA-512:	2E82D282B0A5E549B4D9D1E46CD1CD705D67E0080BD8220D1394EA7895A6CBC384B3D39FB25827B1723232476B50FFB862FE4D59ABDC653A569901A3AC8CA59F
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f.............../....................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFe

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.245441740062931
Encrypted:	false
SSDEEP:	6:NHBqUK9s1923oH+Tcwt0rl2KLlLHBNdpM+q2P923oH+Tcwt0rK+IFUv:NHBGYebeL1HLM+v4Yeb13FUv
MD5:	173271D8FF0F55524A35C060B932631D
SHA1:	A8AF3F01CB68C498A5A1706CA7925CDD919A8F2E
SHA-256:	462BCE6A46D22A94318095F5ECD0FE499E50636E772B50305B645A94D0E76861
SHA-512:	6499763B46581BCFD0364C997004D43B92FAF8B803AB7C5CE16D1AA32D3101B580E3C0D0D30672E9E5A4AC5A74C485DAD149F1F6A234E04DDE013062A9AE069D
Malicious:	false
Preview:	2024/08/28-12:51:03.303 1c8c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/28-12:51:03.746 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.953175538938493
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/WuVf0UJbZfPSAstiN7G0lbANqa:G0nYUtypD3RZ1FZfQtEm
MD5:	3E08A58594ED3D70DD58E2F6E4901139
SHA1:	AAB2279722E939B10FC8155A55801D08CA102ADB
SHA-256:	BCB4A6773A48C9955F61F9BE90296A2F3E6BC42392366DB4372D4D2235C4625F
SHA-512:	5BD9DBCBD93552B2A1091C372FCB7968C0B1BC3102BB07CCA8FEFAFDD5CD85972E5337FAA37FFFBB05ED6E87E0AFB6E1B44FA6A0BBD9E2D6E4F6D0B4A6CBAD36
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....!....................3_.....'}2..................37_.......c..................38_.........................4_.....].$&.................39_.....4.9..................20_......R...................20_.......1..................19_......(...................18_.....:.=..................3_.....R....................37_......%d..................38_......C...................4_.....h.#..................39_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.200195566463209
Encrypted:	false
SSDEEP:	6:NHBfJdGms1923oH+Tcwt0rzs52KLlLHBiM+q2P923oH+Tcwt0rzAdIFUv:NHTdG8Yeb99L1HwM+v4YebyFUv
MD5:	71A2CAF50ED81BE80108FB93491B6FED
SHA1:	DD7313681AB7BB45E9B0CB6009894F542BF15714
SHA-256:	0702F9CD6191D2A9BC3F6926EA7D734D38DD0E448714F9BBE593886B6FED9EFB
SHA-512:	75FDB6A168D397006B3F5E49521D0E8E2F17FBDDEA5481D7F2946C880D3190748E7E235F837A5F09E00990840896FAABB40BDE190CE221AE7F41D9F387B70487
Malicious:	false
Preview:	2024/08/28-12:51:03.247 1c8c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/28-12:51:03.262 1c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlnV0/:Ls3C/
MD5:	86D32108747F932C7C32D1C7004CB8BB
SHA1:	9352EBA623B7E271672F3642EB011673FDCE91A3
SHA-256:	351C3F76E51F3C5A20CE5F045B0AD7B65E555C98B311F20BD1EDF663419056D5
SHA-512:	C23673D4B0ADFDF42330FBFAB1C4A432FC2CA27CB0E411472957864538FEC5AB4160148288068483FAFD6A220B9BF2C0907FD8E957EC0846B8B4C71BA435EF65
Malicious:	false
Preview:	..........................................prW./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlCyBlt:Ls3CyTt
MD5:	65A22C141D4ABD5CF9255CF493879345
SHA1:	9DD12E536C582257B9CC93E661E847F1BD07DDF0
SHA-256:	A4A9B9FF84D9C4C9CEE04727A91611A0078734FE66401304784587CBE5857234
SHA-512:	E0A1062AAE8D3A6EFD4E5AC41785AB806DB5634E2C662B2EC6E15825A99FEDE398F05B09F255377709AF112D271A22A0FB505A2BA841E68C704417516122187D
Malicious:	false
Preview:	........................................d8qrW./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.512991358965762
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt6XBl292Mp3TCIKL96yik9JdXBuBuwBea1qvNhleXg/QQRCYfJ:YuBqDPafk72926DWLOIgBzBevrlewYB0
MD5:	8D56E86F9352CD71BF5E747E60AB13CD
SHA1:	4ECBA8492DAA0954997D3253156C0C94328CF7C1
SHA-256:	FA1EA7946FEF48073B760CC4C1C9973B87F19F30797CC10CE6DE5BF45772ECCE
SHA-512:	FE6FA4BFDEC5135DEF847330BD305A6BBA4C1E9C9DEA53E82AA5C6447DD5DA26E4D4AC34470E38D97E8DFFC450CE9AF8D32C3E7578F4B98F2DFA857D7837D66D
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVMrVesw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369337461571393","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724863861"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF32730.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.512991358965762
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt6XBl292Mp3TCIKL96yik9JdXBuBuwBea1qvNhleXg/QQRCYfJ:YuBqDPafk72926DWLOIgBzBevrlewYB0
MD5:	8D56E86F9352CD71BF5E747E60AB13CD
SHA1:	4ECBA8492DAA0954997D3253156C0C94328CF7C1
SHA-256:	FA1EA7946FEF48073B760CC4C1C9973B87F19F30797CC10CE6DE5BF45772ECCE
SHA-512:	FE6FA4BFDEC5135DEF847330BD305A6BBA4C1E9C9DEA53E82AA5C6447DD5DA26E4D4AC34470E38D97E8DFFC450CE9AF8D32C3E7578F4B98F2DFA857D7837D66D
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVMrVesw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369337461571393","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724863861"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF32963.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.512991358965762
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt6XBl292Mp3TCIKL96yik9JdXBuBuwBea1qvNhleXg/QQRCYfJ:YuBqDPafk72926DWLOIgBzBevrlewYB0
MD5:	8D56E86F9352CD71BF5E747E60AB13CD
SHA1:	4ECBA8492DAA0954997D3253156C0C94328CF7C1
SHA-256:	FA1EA7946FEF48073B760CC4C1C9973B87F19F30797CC10CE6DE5BF45772ECCE
SHA-512:	FE6FA4BFDEC5135DEF847330BD305A6BBA4C1E9C9DEA53E82AA5C6447DD5DA26E4D4AC34470E38D97E8DFFC450CE9AF8D32C3E7578F4B98F2DFA857D7837D66D
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVMrVesw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369337461571393","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724863861"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF32a2e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.512991358965762
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt6XBl292Mp3TCIKL96yik9JdXBuBuwBea1qvNhleXg/QQRCYfJ:YuBqDPafk72926DWLOIgBzBevrlewYB0
MD5:	8D56E86F9352CD71BF5E747E60AB13CD
SHA1:	4ECBA8492DAA0954997D3253156C0C94328CF7C1
SHA-256:	FA1EA7946FEF48073B760CC4C1C9973B87F19F30797CC10CE6DE5BF45772ECCE
SHA-512:	FE6FA4BFDEC5135DEF847330BD305A6BBA4C1E9C9DEA53E82AA5C6447DD5DA26E4D4AC34470E38D97E8DFFC450CE9AF8D32C3E7578F4B98F2DFA857D7837D66D
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVMrVesw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369337461571393","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724863861"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3511f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.512991358965762
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt6XBl292Mp3TCIKL96yik9JdXBuBuwBea1qvNhleXg/QQRCYfJ:YuBqDPafk72926DWLOIgBzBevrlewYB0
MD5:	8D56E86F9352CD71BF5E747E60AB13CD
SHA1:	4ECBA8492DAA0954997D3253156C0C94328CF7C1
SHA-256:	FA1EA7946FEF48073B760CC4C1C9973B87F19F30797CC10CE6DE5BF45772ECCE
SHA-512:	FE6FA4BFDEC5135DEF847330BD305A6BBA4C1E9C9DEA53E82AA5C6447DD5DA26E4D4AC34470E38D97E8DFFC450CE9AF8D32C3E7578F4B98F2DFA857D7837D66D
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVMrVesw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369337461571393","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724863861"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF39471.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.512991358965762
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt6XBl292Mp3TCIKL96yik9JdXBuBuwBea1qvNhleXg/QQRCYfJ:YuBqDPafk72926DWLOIgBzBevrlewYB0
MD5:	8D56E86F9352CD71BF5E747E60AB13CD
SHA1:	4ECBA8492DAA0954997D3253156C0C94328CF7C1
SHA-256:	FA1EA7946FEF48073B760CC4C1C9973B87F19F30797CC10CE6DE5BF45772ECCE
SHA-512:	FE6FA4BFDEC5135DEF847330BD305A6BBA4C1E9C9DEA53E82AA5C6447DD5DA26E4D4AC34470E38D97E8DFFC450CE9AF8D32C3E7578F4B98F2DFA857D7837D66D
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVMrVesw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369337461571393","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724863861"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF413a3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.512991358965762
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt6XBl292Mp3TCIKL96yik9JdXBuBuwBea1qvNhleXg/QQRCYfJ:YuBqDPafk72926DWLOIgBzBevrlewYB0
MD5:	8D56E86F9352CD71BF5E747E60AB13CD
SHA1:	4ECBA8492DAA0954997D3253156C0C94328CF7C1
SHA-256:	FA1EA7946FEF48073B760CC4C1C9973B87F19F30797CC10CE6DE5BF45772ECCE
SHA-512:	FE6FA4BFDEC5135DEF847330BD305A6BBA4C1E9C9DEA53E82AA5C6447DD5DA26E4D4AC34470E38D97E8DFFC450CE9AF8D32C3E7578F4B98F2DFA857D7837D66D
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVMrVesw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369337461571393","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724863861"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF43ac3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.512991358965762
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt6XBl292Mp3TCIKL96yik9JdXBuBuwBea1qvNhleXg/QQRCYfJ:YuBqDPafk72926DWLOIgBzBevrlewYB0
MD5:	8D56E86F9352CD71BF5E747E60AB13CD
SHA1:	4ECBA8492DAA0954997D3253156C0C94328CF7C1
SHA-256:	FA1EA7946FEF48073B760CC4C1C9973B87F19F30797CC10CE6DE5BF45772ECCE
SHA-512:	FE6FA4BFDEC5135DEF847330BD305A6BBA4C1E9C9DEA53E82AA5C6447DD5DA26E4D4AC34470E38D97E8DFFC450CE9AF8D32C3E7578F4B98F2DFA857D7837D66D
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVMrVesw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369337461571393","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724863861"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF4998d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.512991358965762
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt6XBl292Mp3TCIKL96yik9JdXBuBuwBea1qvNhleXg/QQRCYfJ:YuBqDPafk72926DWLOIgBzBevrlewYB0
MD5:	8D56E86F9352CD71BF5E747E60AB13CD
SHA1:	4ECBA8492DAA0954997D3253156C0C94328CF7C1
SHA-256:	FA1EA7946FEF48073B760CC4C1C9973B87F19F30797CC10CE6DE5BF45772ECCE
SHA-512:	FE6FA4BFDEC5135DEF847330BD305A6BBA4C1E9C9DEA53E82AA5C6447DD5DA26E4D4AC34470E38D97E8DFFC450CE9AF8D32C3E7578F4B98F2DFA857D7837D66D
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVMrVesw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369337461571393","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724863861"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlx:Ls3x
MD5:	5F8B0BC7FAA05569DDF100BC69960293
SHA1:	BB6967B11E0C70ACF99565FB329458336D21D453
SHA-256:	E62F41CEAD618CD0701BDB17726465064E02869FA6B1E81EA6690C6736E820D0
SHA-512:	2757A44F257CC7914CC1F3333DBAA56A55E471D0301DAC6507BB3D3476EDF45F3AF599CE877BAB7B4310AF5D1D598F04B59E676A9BEBE09BF119D2E94634F754
Malicious:	false
Preview:	..........................................HrW./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\b00a7934-674e-4bb8-a49e-a49e972aebd4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3334
Entropy (8bit):	5.604461522929762
Encrypted:	false
SSDEEP:	96:0q8NkC1fkCFDW3r2B3PvQvlBeJkNc5SDS4S4SDSt7I4a:/8Nbif6KlB6kNg
MD5:	096A05229BB8C68602585B47505447A7
SHA1:	A1D43E90A3E3972A7282AB01DA2FECA228BDB266
SHA-256:	1A54CE9FE566F128BF286F350B88F5AD26157B29CFEB449D9C2FA136CA4CE035
SHA-512:	740B7979A72BAC28CC7F683A0D63012034FF3A0DEB52A5802BDAC4A5CA77847240D790C004AA7E89704B934E607BD9031651845C61108AC7B1165F862B5F470D
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVMrVesw=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\e5477f97-32e6-4ec2-8e85-2c8c21c3d0d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2957
Entropy (8bit):	5.58095097964491
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afk72926DWLWwIkHB++drxYCvBevchRwmaJkXKRocVwlRmiB0:Xq8NkC1fkCFDW3bB3PvQvmwfJkNcixq
MD5:	A44D75F714F87D89A3663BC3310B469E
SHA1:	B21B83A955949BABA2200B153E97EA8FDBBDE08F
SHA-256:	21C86DA9D450FACD3075118181D4568E4B729F87352E139EEDB6F2CB547E4928
SHA-512:	CF0F3E6AF5D2F8A419A4FE1FD994BE77240A704479548305F6699F40606899A265CA0EF4BC167A67E3A0F159C590D44C2C83196CC4DDF60FACD4D3866FA5EFA8
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVMrVesw=="},"policy":{"last_statistics_update":"13369337461597006"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\f352e990-c4db-45de-abe4-0a01993c47e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.512991358965762
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt6XBl292Mp3TCIKL96yik9JdXBuBuwBea1qvNhleXg/QQRCYfJ:YuBqDPafk72926DWLOIgBzBevrlewYB0
MD5:	8D56E86F9352CD71BF5E747E60AB13CD
SHA1:	4ECBA8492DAA0954997D3253156C0C94328CF7C1
SHA-256:	FA1EA7946FEF48073B760CC4C1C9973B87F19F30797CC10CE6DE5BF45772ECCE
SHA-512:	FE6FA4BFDEC5135DEF847330BD305A6BBA4C1E9C9DEA53E82AA5C6447DD5DA26E4D4AC34470E38D97E8DFFC450CE9AF8D32C3E7578F4B98F2DFA857D7837D66D
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAC5giAEMo3XSoqLgNWytIyoEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADT1P80ARMfXMaB4nWq8yrxJszw5MaEupKWzlrEivWNxAAAAAAOgAAAAAIAACAAAAB66ARhHg7ByHaB8CTeSzkzWX1gF0AX+rRV55fs2meWRTAAAAA3pC+89syxPSPB5x3f8qlIcTJmMd+03lVEMFOOeNL+40wEe/Q0j9y+ba8srVR3cjhAAAAAZQt9SfTChBzeBgf9Ig2A19XtITsgaTdSp0EQDflGVWyttHjBYZpAhjnLvo3g/OpoijoQwULLcY1w6EwVMrVesw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369337461571393","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1724863861"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\11979f7a-cddd-47a4-b4d0-76f46197b34b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907570806173945
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Xtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEV6Gtbz8hu3VlXr4CRo1
MD5:	2404F6BC473FB23B2B33898B89DEA0CE
SHA1:	7678A4195D489BACFF4062133F9FF254ABA7D963
SHA-256:	E8CD7FB927C9D62F734B22C932AAB274A76A78BEB3C093E8C6220035EC0A54F3
SHA-512:	D0F985E95A575334306FB68873A37209A3189738C5F83DC310717272D35FCD2655B9AC63E2E52CCDFCD50F0BE3F54681B5C50FDAE34E898E3EEC9896E18ECEE7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\73c7ee7b-0c90-41bf-a0bc-a894af8f36fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44665
Entropy (8bit):	6.0960647557132654
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBlFuIhDO6vP6Oushb3OgfJNJDIbY4cGoup1Xl3jVu:z/Ps+wsI7yOEk67hrXQchu3VlXr4CRo1
MD5:	FDA7B00CB030146378E496B714AA7832
SHA1:	6843986FE8D8007BC73807795F5AA0D2B9600880
SHA-256:	117536074C3CD1A2A14FF6E13D1496F6F43A73AA1E45E925A050AEB10BA05AB9
SHA-512:	6BAF17CB434250D3A07FCAB7FDFEDF4BDDCA5022FAB9106C0A00C06321829759D25811183358A66A630ACD6108BFFA1E20AEB7CC44BBDFC7E6C05D5A91427142
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\909f55d5-f538-4ae8-a066-f73bef2188d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44664
Entropy (8bit):	6.096087473420995
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBlwuIhDO6vP6Oushb3OgfGNJDIbY4cGoup1Xl3jVu:z/Ps+wsI7yOEf67hrXJchu3VlXr4CRo1
MD5:	E4CF8EDDB3617E1D7633B1830BECE2A0
SHA1:	D3EEBF74864FF7ACC843BBC86555A7CDA55C9BF7
SHA-256:	4CFA26100030F41F00A21A2701F7B8FB47EC5B09D6BC4671586533DA26C363C8
SHA-512:	725188D682FE05EE2923B5A753C012DA9B3ECE872CC9786A1FEC9DD8BC31BA6315684CC1D7891772DD884156BC6A9F43D0B3984D73DF84307BA3B49B858FF6E1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9c13a416-72bb-4859-891b-ef77d55fadaf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44665
Entropy (8bit):	6.0960647557132654
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBlFuIhDO6vP6Oushb3OgfJNJDIbY4cGoup1Xl3jVu:z/Ps+wsI7yOEk67hrXQchu3VlXr4CRo1
MD5:	FDA7B00CB030146378E496B714AA7832
SHA1:	6843986FE8D8007BC73807795F5AA0D2B9600880
SHA-256:	117536074C3CD1A2A14FF6E13D1496F6F43A73AA1E45E925A050AEB10BA05AB9
SHA-512:	6BAF17CB434250D3A07FCAB7FDFEDF4BDDCA5022FAB9106C0A00C06321829759D25811183358A66A630ACD6108BFFA1E20AEB7CC44BBDFC7E6C05D5A91427142
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CF558F-1784.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.1283808774472225
Encrypted:	false
SSDEEP:	768:NJbt5fTqjUMZHAXjRGOuii3R9aL2pPi/GQPFORGO:NJh5fOjrZHGjRGVbR9rpiGaFORG
MD5:	20F27CD043834B464C7A17AB303C5CF5
SHA1:	FFC02460BEC3682ED53408F399B70BC1CB5309C9
SHA-256:	615B25D2816E5D1B1E2E4B2BF8116A01388ACC64B4C4B7B56734AA288316F43C
SHA-512:	AFE438354D4CFDA63A7AB48020E3415F8A65BE60EFFF58AD74FC569E9A535EC092E2BE6B751E9F2FC2EEE91F0BCBBB4E49E0296EC4AE0C00863912100F0D3175
Malicious:	false
Preview:	...@..@...@.....C.].....@................%..`...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".tcbmkt20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U].0r........>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\049bd3fb-697b-41d3-8de3-1ecef1024021.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\797ac687-294d-4335-97c7-39074d2deb75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7818
Entropy (8bit):	5.0898369294978085
Encrypted:	false
SSDEEP:	192:stZrs2nx8CZihnkZsY8bV+FiA66WbDaFIMYYbLMJ:stZrs4x8xhlbGix6WbDaTY3
MD5:	D2FD45D425AB1665FAEA3BAD9FD5150B
SHA1:	15C289FA03B590230C2A3F43330AF767AF803BD9
SHA-256:	3B9EA4476683E1242CB28B025EC1E4AFFA65DA36D3FE67DB33476DEA09A363B2
SHA-512:	76BA5F2EF9BCAA163D5232C6849F16541BFCAE27A60326BE79C1ADD527D6DB8C480456C46CD6B89C60949FE435A463D633C03ED7F06BFE3E5166E7798671DB9E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369337480368806","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13369337480368622"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7a6dea98-f71f-470d-aded-fc070e81030a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.1448834854647805
Encrypted:	false
SSDEEP:	6:NHBdBM+q2P923oH+TcwtnG2tMsIFUt88HBdjZmw+8HBdeMVkwO923oH+TcwtnG2b:NHFM+v4Yebn9GFUt88HP/+8HCMV5LYeV
MD5:	BD9ADC0A4E5D9636F60DE0AC72C9C087
SHA1:	772929D3864FFD2213F1F2ADFBAD549D58FCB933
SHA-256:	AD6EFB9B19FE7DA3ADC546DB03ABE3F8C8B210FB951E7397787612D6FB1EFC42
SHA-512:	91827DA7B2A93E550E1F0843277BF53025C090793BC3954579D4B7962D4C87EEACC0127E260557483242B570BB8DE67BBA762F4B8F40171D372530A42FE596B9
Malicious:	false
Preview:	2024/08/28-12:51:20.111 23fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/08/28-12:51:20.112 23fc Recovering log #3.2024/08/28-12:51:20.112 23fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.1448834854647805
Encrypted:	false
SSDEEP:	6:NHBdBM+q2P923oH+TcwtnG2tMsIFUt88HBdjZmw+8HBdeMVkwO923oH+TcwtnG2b:NHFM+v4Yebn9GFUt88HP/+8HCMV5LYeV
MD5:	BD9ADC0A4E5D9636F60DE0AC72C9C087
SHA1:	772929D3864FFD2213F1F2ADFBAD549D58FCB933
SHA-256:	AD6EFB9B19FE7DA3ADC546DB03ABE3F8C8B210FB951E7397787612D6FB1EFC42
SHA-512:	91827DA7B2A93E550E1F0843277BF53025C090793BC3954579D4B7962D4C87EEACC0127E260557483242B570BB8DE67BBA762F4B8F40171D372530A42FE596B9
Malicious:	false
Preview:	2024/08/28-12:51:20.111 23fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/08/28-12:51:20.112 23fc Recovering log #3.2024/08/28-12:51:20.112 23fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old~RF38e66.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.1448834854647805
Encrypted:	false
SSDEEP:	6:NHBdBM+q2P923oH+TcwtnG2tMsIFUt88HBdjZmw+8HBdeMVkwO923oH+TcwtnG2b:NHFM+v4Yebn9GFUt88HP/+8HCMV5LYeV
MD5:	BD9ADC0A4E5D9636F60DE0AC72C9C087
SHA1:	772929D3864FFD2213F1F2ADFBAD549D58FCB933
SHA-256:	AD6EFB9B19FE7DA3ADC546DB03ABE3F8C8B210FB951E7397787612D6FB1EFC42
SHA-512:	91827DA7B2A93E550E1F0843277BF53025C090793BC3954579D4B7962D4C87EEACC0127E260557483242B570BB8DE67BBA762F4B8F40171D372530A42FE596B9
Malicious:	false
Preview:	2024/08/28-12:51:20.111 23fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/08/28-12:51:20.112 23fc Recovering log #3.2024/08/28-12:51:20.112 23fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.118166466320401
Encrypted:	false
SSDEEP:	6:NHBdlsM+q2P923oH+Tcwt8aPrqIFUt88HBdPmZmw+8HBdPpMVkwO923oH+Tcwt8h:NHhsM+v4YebL3FUt88HLm/+8HLpMV5LE
MD5:	564577A9B51EE3324ED6B807A2A9FAAB
SHA1:	36A986858D101E838A993FF68ED08877D957C60A
SHA-256:	C205C3682C0FED186818AFE509436C8E6A4A17E23832E88CC5D3BFA7E98D4E74
SHA-512:	03A09160E70A9C2E4EB3EB1ACFCF7169B997E60D57F7D3640807225D9C373E80EB1FBCD2DD1ABC1B9BBF8F96079137B57B344C836794ADB38536E87C2EB9CA83
Malicious:	false
Preview:	2024/08/28-12:51:20.123 23fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/08/28-12:51:20.124 23fc Recovering log #3.2024/08/28-12:51:20.124 23fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.118166466320401
Encrypted:	false
SSDEEP:	6:NHBdlsM+q2P923oH+Tcwt8aPrqIFUt88HBdPmZmw+8HBdPpMVkwO923oH+Tcwt8h:NHhsM+v4YebL3FUt88HLm/+8HLpMV5LE
MD5:	564577A9B51EE3324ED6B807A2A9FAAB
SHA1:	36A986858D101E838A993FF68ED08877D957C60A
SHA-256:	C205C3682C0FED186818AFE509436C8E6A4A17E23832E88CC5D3BFA7E98D4E74
SHA-512:	03A09160E70A9C2E4EB3EB1ACFCF7169B997E60D57F7D3640807225D9C373E80EB1FBCD2DD1ABC1B9BBF8F96079137B57B344C836794ADB38536E87C2EB9CA83
Malicious:	false
Preview:	2024/08/28-12:51:20.123 23fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/08/28-12:51:20.124 23fc Recovering log #3.2024/08/28-12:51:20.124 23fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.143368524657657
Encrypted:	false
SSDEEP:	6:NHBd+M+q2P923oH+Tcwt865IFUt88HBdwXZmw+8HBdwqMVkwO923oH+Tcwt86+Ud:NHyM+v4Yeb/WFUt88H4/+8H7MV5LYebD
MD5:	2420FBE58BACCD50740214ACD252FC41
SHA1:	460732199266823D9BB219D1F07D34A1038D1BD0
SHA-256:	79767A9640184ACAC46D9284054C687F7BA9FFE5BDD90A6EBDD74C6106C1B81B
SHA-512:	F6C1E08DE5E998CC377BC7C7612C27F0B787BAF99BD45F7DE98072F287B1AD485E025DBCCCAE115A670E8C16C00CF73A2E4CCF19F42529ECBAD2ADCA33CA996E
Malicious:	false
Preview:	2024/08/28-12:51:20.138 23fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/08/28-12:51:20.144 23fc Recovering log #3.2024/08/28-12:51:20.144 23fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.143368524657657
Encrypted:	false
SSDEEP:	6:NHBd+M+q2P923oH+Tcwt865IFUt88HBdwXZmw+8HBdwqMVkwO923oH+Tcwt86+Ud:NHyM+v4Yeb/WFUt88H4/+8H7MV5LYebD
MD5:	2420FBE58BACCD50740214ACD252FC41
SHA1:	460732199266823D9BB219D1F07D34A1038D1BD0
SHA-256:	79767A9640184ACAC46D9284054C687F7BA9FFE5BDD90A6EBDD74C6106C1B81B
SHA-512:	F6C1E08DE5E998CC377BC7C7612C27F0B787BAF99BD45F7DE98072F287B1AD485E025DBCCCAE115A670E8C16C00CF73A2E4CCF19F42529ECBAD2ADCA33CA996E
Malicious:	false
Preview:	2024/08/28-12:51:20.138 23fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/08/28-12:51:20.144 23fc Recovering log #3.2024/08/28-12:51:20.144 23fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	914FD8DC5F9A741C6947E1AB12A9D113
SHA1:	6529EFE14E7B0BEA47D78B147243096408CDAAE4
SHA-256:	8BE3C96EE64B5D2768057EA1C4D1A70F40A0041585F3173806E2278E9300960B
SHA-512:	2862BF83C061414EFA2AC035FFC25BA9C4ED523B430FDEEED4974F55D4450A62766C2E799D0ACDB8269210078547048ACAABFD78EDE6AB91133E30F6B5EBFFBD
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.163101942207416
Encrypted:	false
SSDEEP:	6:NHBVBq2P923oH+Tcwt8NIFUt88HBV8Zmw+8HBVvBzkwO923oH+Tcwt8+eLJ:NHdv4YebpFUt88H4/+8HLBz5LYebqJ
MD5:	5139AA4AC19AC7BB815D4F71B9D2E22F
SHA1:	1686E4081D97B3E3F499C422394DEE162002AF23
SHA-256:	0DD7C5A293B0AD9EF96F2DDE10A5011384C19D5E0DC0E36905ADBD65BE7E0B72
SHA-512:	ED21484D906040FC30406ECB7088607EDAD4C0CFA6D0AED2AEF94E358642FB5584FAA1F83C536A51143A6F19F8101429173F00555AE4B53B4D5A3C4F281B69DC
Malicious:	false
Preview:	2024/08/28-12:51:28.384 2394 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/28-12:51:28.384 2394 Recovering log #3.2024/08/28-12:51:28.385 2394 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.163101942207416
Encrypted:	false
SSDEEP:	6:NHBVBq2P923oH+Tcwt8NIFUt88HBV8Zmw+8HBVvBzkwO923oH+Tcwt8+eLJ:NHdv4YebpFUt88H4/+8HLBz5LYebqJ
MD5:	5139AA4AC19AC7BB815D4F71B9D2E22F
SHA1:	1686E4081D97B3E3F499C422394DEE162002AF23
SHA-256:	0DD7C5A293B0AD9EF96F2DDE10A5011384C19D5E0DC0E36905ADBD65BE7E0B72
SHA-512:	ED21484D906040FC30406ECB7088607EDAD4C0CFA6D0AED2AEF94E358642FB5584FAA1F83C536A51143A6F19F8101429173F00555AE4B53B4D5A3C4F281B69DC
Malicious:	false
Preview:	2024/08/28-12:51:28.384 2394 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/28-12:51:28.384 2394 Recovering log #3.2024/08/28-12:51:28.385 2394 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old~RF38ed3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.163101942207416
Encrypted:	false
SSDEEP:	6:NHBVBq2P923oH+Tcwt8NIFUt88HBV8Zmw+8HBVvBzkwO923oH+Tcwt8+eLJ:NHdv4YebpFUt88H4/+8HLBz5LYebqJ
MD5:	5139AA4AC19AC7BB815D4F71B9D2E22F
SHA1:	1686E4081D97B3E3F499C422394DEE162002AF23
SHA-256:	0DD7C5A293B0AD9EF96F2DDE10A5011384C19D5E0DC0E36905ADBD65BE7E0B72
SHA-512:	ED21484D906040FC30406ECB7088607EDAD4C0CFA6D0AED2AEF94E358642FB5584FAA1F83C536A51143A6F19F8101429173F00555AE4B53B4D5A3C4F281B69DC
Malicious:	false
Preview:	2024/08/28-12:51:28.384 2394 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/28-12:51:28.384 2394 Recovering log #3.2024/08/28-12:51:28.385 2394 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.131077162080029
Encrypted:	false
SSDEEP:	6:NHBESk4q2P923oH+Tcwt8a2jMGIFUt88HBEHKBNJZmw+8HBORNDkwO923oH+Tcw2:NHWSk4v4Yeb8EFUt88HWqBNJ/+8HaD5U
MD5:	8916F5C9218A8A39E7E53795AC603A52
SHA1:	648E148BD0AD5D5609BE5FFC8CD18C449D3F90E7
SHA-256:	30937EAD966DFE48427EBF9E814C28B0B88EF5A54FA1F1E783C97B457DD7C0B1
SHA-512:	691534C4288D33893C2CAB31CC1A4D86FC086673B5F909664CEB5CE675373FD1714306AFAA3939BA03B15C46E2475902D8A415984BA1DEDAC1AC1AF937F43951
Malicious:	false
Preview:	2024/08/28-12:51:21.207 1624 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/28-12:51:21.208 1624 Recovering log #3.2024/08/28-12:51:21.210 1624 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.131077162080029
Encrypted:	false
SSDEEP:	6:NHBESk4q2P923oH+Tcwt8a2jMGIFUt88HBEHKBNJZmw+8HBORNDkwO923oH+Tcw2:NHWSk4v4Yeb8EFUt88HWqBNJ/+8HaD5U
MD5:	8916F5C9218A8A39E7E53795AC603A52
SHA1:	648E148BD0AD5D5609BE5FFC8CD18C449D3F90E7
SHA-256:	30937EAD966DFE48427EBF9E814C28B0B88EF5A54FA1F1E783C97B457DD7C0B1
SHA-512:	691534C4288D33893C2CAB31CC1A4D86FC086673B5F909664CEB5CE675373FD1714306AFAA3939BA03B15C46E2475902D8A415984BA1DEDAC1AC1AF937F43951
Malicious:	false
Preview:	2024/08/28-12:51:21.207 1624 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/28-12:51:21.208 1624 Recovering log #3.2024/08/28-12:51:21.210 1624 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\84ca81d1-8acd-4ecd-83bf-46acf91ff7ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9d16dc18-8f07-446f-a57c-4aad91a3a811.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7818
Entropy (8bit):	5.0898369294978085
Encrypted:	false
SSDEEP:	192:stZrs2nx8CZihnkZsY8bV+FiA66WbDaFIMYYbLMJ:stZrs4x8xhlbGix6WbDaTY3
MD5:	D2FD45D425AB1665FAEA3BAD9FD5150B
SHA1:	15C289FA03B590230C2A3F43330AF767AF803BD9
SHA-256:	3B9EA4476683E1242CB28B025EC1E4AFFA65DA36D3FE67DB33476DEA09A363B2
SHA-512:	76BA5F2EF9BCAA163D5232C6849F16541BFCAE27A60326BE79C1ADD527D6DB8C480456C46CD6B89C60949FE435A463D633C03ED7F06BFE3E5166E7798671DB9E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369337480368806","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13369337480368622"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF38f41.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7818
Entropy (8bit):	5.0898369294978085
Encrypted:	false
SSDEEP:	192:stZrs2nx8CZihnkZsY8bV+FiA66WbDaFIMYYbLMJ:stZrs4x8xhlbGix6WbDaTY3
MD5:	D2FD45D425AB1665FAEA3BAD9FD5150B
SHA1:	15C289FA03B590230C2A3F43330AF767AF803BD9
SHA-256:	3B9EA4476683E1242CB28B025EC1E4AFFA65DA36D3FE67DB33476DEA09A363B2
SHA-512:	76BA5F2EF9BCAA163D5232C6849F16541BFCAE27A60326BE79C1ADD527D6DB8C480456C46CD6B89C60949FE435A463D633C03ED7F06BFE3E5166E7798671DB9E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369337480368806","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13369337480368622"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24691
Entropy (8bit):	5.568343817984221
Encrypted:	false
SSDEEP:	768:UfS6etWPpEfu18F1+UoAYDCx9Tuqh0VfUC9xbog/OVMFksFrwjpMtuP:UfS6etWPpEfu1u1jaZusuqtg
MD5:	2E18DD1FA54E18AE06510A5A6C1D96B1
SHA1:	E0B38618720FD11FC638B09E83C48B769F857F1C
SHA-256:	6B6915A4756D9A1F55A253285C9A11577451A04FAB291AEAD75AAC718B766A14
SHA-512:	E21BC12C50BE020F08B718049868D91D355F6B8EA46732CAF222707A3FBF8D1BB17E1ADA81DB64140286B564A294BF9D1BEE7E9FE6B3B5DCA28B4B771C361708
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369337480101549","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369337480101549","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.149362834365528
Encrypted:	false
SSDEEP:	6:NHBNKXL4q2P923oH+TcwtrQMxIFUt88HB2FUPJZmw+8HBpLDkwO923oH+TcwtrQq:NHfKXL4v4YebCFUt88HIkJ/+8H7LD5Ln
MD5:	BC16C400ECB018C9214EC8842DA1919C
SHA1:	2C20405EFBF6AF25D2615EEC00D4AC5BBA7E447F
SHA-256:	27948800F630694EE3A74307A70DE71C8EA57064ED3693FB2697EAE9ACF6781F
SHA-512:	7E32952A2DF82961D907DD3D650B8AD6268390249C06824B566EFB7957233825F419C11F64AFB8B4260265D66003D3B288E4EE6017F4C8EAD62D9B0FC9964C1D
Malicious:	false
Preview:	2024/08/28-12:51:21.157 1624 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/28-12:51:21.167 1624 Recovering log #3.2024/08/28-12:51:21.198 1624 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.149362834365528
Encrypted:	false
SSDEEP:	6:NHBNKXL4q2P923oH+TcwtrQMxIFUt88HB2FUPJZmw+8HBpLDkwO923oH+TcwtrQq:NHfKXL4v4YebCFUt88HIkJ/+8H7LD5Ln
MD5:	BC16C400ECB018C9214EC8842DA1919C
SHA1:	2C20405EFBF6AF25D2615EEC00D4AC5BBA7E447F
SHA-256:	27948800F630694EE3A74307A70DE71C8EA57064ED3693FB2697EAE9ACF6781F
SHA-512:	7E32952A2DF82961D907DD3D650B8AD6268390249C06824B566EFB7957233825F419C11F64AFB8B4260265D66003D3B288E4EE6017F4C8EAD62D9B0FC9964C1D
Malicious:	false
Preview:	2024/08/28-12:51:21.157 1624 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/28-12:51:21.167 1624 Recovering log #3.2024/08/28-12:51:21.198 1624 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.118597398133931
Encrypted:	false
SSDEEP:	6:NHBdCA+q2P923oH+Tcwt7Uh2ghZIFUt88HBddZZmw+8HBdNiVkwO923oH+Tcwt7w:NHmv4YebIhHh2FUt88HpZ/+8HRa5LYeQ
MD5:	3BB522B50C3C7A5FA4F98ACED62195F8
SHA1:	003D06DBDEBD8ED1B664C60DD46C8B21F929C1C1
SHA-256:	824BED80BCE25232783FFDDB3B7994D9D249CE7856DD8A99328D494483B8D8A8
SHA-512:	64601B5655DC36F08C005649D3BEA6EBFE919230D7FEFA64188F2C923CAD53209E2348B13AE3C1CFD97E3111B2266BE25AF70F1E7890513903A5CA4049EC7CE1
Malicious:	false
Preview:	2024/08/28-12:51:20.139 23f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/28-12:51:20.140 23f8 Recovering log #3.2024/08/28-12:51:20.141 23f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.118597398133931
Encrypted:	false
SSDEEP:	6:NHBdCA+q2P923oH+Tcwt7Uh2ghZIFUt88HBddZZmw+8HBdNiVkwO923oH+Tcwt7w:NHmv4YebIhHh2FUt88HpZ/+8HRa5LYeQ
MD5:	3BB522B50C3C7A5FA4F98ACED62195F8
SHA1:	003D06DBDEBD8ED1B664C60DD46C8B21F929C1C1
SHA-256:	824BED80BCE25232783FFDDB3B7994D9D249CE7856DD8A99328D494483B8D8A8
SHA-512:	64601B5655DC36F08C005649D3BEA6EBFE919230D7FEFA64188F2C923CAD53209E2348B13AE3C1CFD97E3111B2266BE25AF70F1E7890513903A5CA4049EC7CE1
Malicious:	false
Preview:	2024/08/28-12:51:20.139 23f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/28-12:51:20.140 23f8 Recovering log #3.2024/08/28-12:51:20.141 23f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old~RF38ea5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.118597398133931
Encrypted:	false
SSDEEP:	6:NHBdCA+q2P923oH+Tcwt7Uh2ghZIFUt88HBddZZmw+8HBdNiVkwO923oH+Tcwt7w:NHmv4YebIhHh2FUt88HpZ/+8HRa5LYeQ
MD5:	3BB522B50C3C7A5FA4F98ACED62195F8
SHA1:	003D06DBDEBD8ED1B664C60DD46C8B21F929C1C1
SHA-256:	824BED80BCE25232783FFDDB3B7994D9D249CE7856DD8A99328D494483B8D8A8
SHA-512:	64601B5655DC36F08C005649D3BEA6EBFE919230D7FEFA64188F2C923CAD53209E2348B13AE3C1CFD97E3111B2266BE25AF70F1E7890513903A5CA4049EC7CE1
Malicious:	false
Preview:	2024/08/28-12:51:20.139 23f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/28-12:51:20.140 23f8 Recovering log #3.2024/08/28-12:51:20.141 23f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.222584853267811
Encrypted:	false
SSDEEP:	12:NHeWeIv4YebvqBQFUt88H9Yz1/+8H3z5LYebvqBvJ:N+64YebvZg88dYPXlLYebvk
MD5:	17499A23DE955B94E90D8F93F0777E0B
SHA1:	FDAFB164EA8BF12E8A31B294A9022D953C648961
SHA-256:	D68FAD06413360CD8994F765C97F4B14931BF4A14CF60E1BE6803EA112627C72
SHA-512:	9C16052EEC4A8DA3588A93A4D25CA8E19AEE67F2A7EF8B43DBE83DB1112FD77ECC6A26E9A37AFD7CB7D2039BB3B907DA22D985FD894054E175D3B14AA872995C
Malicious:	false
Preview:	2024/08/28-12:51:21.283 17a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/28-12:51:21.331 17a8 Recovering log #3.2024/08/28-12:51:21.341 17a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.222584853267811
Encrypted:	false
SSDEEP:	12:NHeWeIv4YebvqBQFUt88H9Yz1/+8H3z5LYebvqBvJ:N+64YebvZg88dYPXlLYebvk
MD5:	17499A23DE955B94E90D8F93F0777E0B
SHA1:	FDAFB164EA8BF12E8A31B294A9022D953C648961
SHA-256:	D68FAD06413360CD8994F765C97F4B14931BF4A14CF60E1BE6803EA112627C72
SHA-512:	9C16052EEC4A8DA3588A93A4D25CA8E19AEE67F2A7EF8B43DBE83DB1112FD77ECC6A26E9A37AFD7CB7D2039BB3B907DA22D985FD894054E175D3B14AA872995C
Malicious:	false
Preview:	2024/08/28-12:51:21.283 17a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/28-12:51:21.331 17a8 Recovering log #3.2024/08/28-12:51:21.341 17a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.2283535353537
Encrypted:	false
SSDEEP:	12:NHwb4v4YebvqBZFUt88HeYNJ/+8He4D5LYebvqBaJ:NQK4Yebvyg88+q/+4VLYebvL
MD5:	C1DB295B0C3D123ABE750FE49142DDAB
SHA1:	20C00D83D9735E737AB4727FE75D8282E7284B8A
SHA-256:	D4B233063C2E2C341195770285B5B348DA3BCDBDB1884275096AFB54722B861E
SHA-512:	6610C3DA50DEACF1ADA5A2EEE4E0EDFAE56B479BCC9646D9B95BBB23A10F8E87EE0AF147EB6B7907741D17370A77FC76BB25877569B4E5FFFE6583A78B11A879
Malicious:	false
Preview:	2024/08/28-12:51:21.278 1624 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/28-12:51:21.280 1624 Recovering log #3.2024/08/28-12:51:21.286 1624 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.2283535353537
Encrypted:	false
SSDEEP:	12:NHwb4v4YebvqBZFUt88HeYNJ/+8He4D5LYebvqBaJ:NQK4Yebvyg88+q/+4VLYebvL
MD5:	C1DB295B0C3D123ABE750FE49142DDAB
SHA1:	20C00D83D9735E737AB4727FE75D8282E7284B8A
SHA-256:	D4B233063C2E2C341195770285B5B348DA3BCDBDB1884275096AFB54722B861E
SHA-512:	6610C3DA50DEACF1ADA5A2EEE4E0EDFAE56B479BCC9646D9B95BBB23A10F8E87EE0AF147EB6B7907741D17370A77FC76BB25877569B4E5FFFE6583A78B11A879
Malicious:	false
Preview:	2024/08/28-12:51:21.278 1624 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/28-12:51:21.280 1624 Recovering log #3.2024/08/28-12:51:21.286 1624 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.156943989016515
Encrypted:	false
SSDEEP:	6:NHBdhQdtNq2P923oH+TcwtpIFUt88HBdhQ3XZmw+8HBdhYzkwO923oH+Tcwta/Wd:NHu7v4YebmFUt88HmX/+8H+z5LYebaUJ
MD5:	DA12B63F5689AE61440E4ACA7BD7D072
SHA1:	536555AA0D202F8DC23079C2648341C32E0C5CEF
SHA-256:	8BEF187881289B764ABFFD60D8328BF8F5FEDE97AE6A3F9C4FDD1A5361B4E56C
SHA-512:	938EE2C567CD15AE7F2072AD3B078B1332460B5263518AA8B0F0ACEAA1A37D6EF6D6FBBA113BA47A9AA3B4E16A14B4424ED322B5010D6976F61C4380AF65905D
Malicious:	false
Preview:	2024/08/28-12:51:20.058 23f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/28-12:51:20.059 23f0 Recovering log #3.2024/08/28-12:51:20.060 23f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.156943989016515
Encrypted:	false
SSDEEP:	6:NHBdhQdtNq2P923oH+TcwtpIFUt88HBdhQ3XZmw+8HBdhYzkwO923oH+Tcwta/Wd:NHu7v4YebmFUt88HmX/+8H+z5LYebaUJ
MD5:	DA12B63F5689AE61440E4ACA7BD7D072
SHA1:	536555AA0D202F8DC23079C2648341C32E0C5CEF
SHA-256:	8BEF187881289B764ABFFD60D8328BF8F5FEDE97AE6A3F9C4FDD1A5361B4E56C
SHA-512:	938EE2C567CD15AE7F2072AD3B078B1332460B5263518AA8B0F0ACEAA1A37D6EF6D6FBBA113BA47A9AA3B4E16A14B4424ED322B5010D6976F61C4380AF65905D
Malicious:	false
Preview:	2024/08/28-12:51:20.058 23f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/28-12:51:20.059 23f0 Recovering log #3.2024/08/28-12:51:20.060 23f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old~RF38e76.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.156943989016515
Encrypted:	false
SSDEEP:	6:NHBdhQdtNq2P923oH+TcwtpIFUt88HBdhQ3XZmw+8HBdhYzkwO923oH+Tcwta/Wd:NHu7v4YebmFUt88HmX/+8H+z5LYebaUJ
MD5:	DA12B63F5689AE61440E4ACA7BD7D072
SHA1:	536555AA0D202F8DC23079C2648341C32E0C5CEF
SHA-256:	8BEF187881289B764ABFFD60D8328BF8F5FEDE97AE6A3F9C4FDD1A5361B4E56C
SHA-512:	938EE2C567CD15AE7F2072AD3B078B1332460B5263518AA8B0F0ACEAA1A37D6EF6D6FBBA113BA47A9AA3B4E16A14B4424ED322B5010D6976F61C4380AF65905D
Malicious:	false
Preview:	2024/08/28-12:51:20.058 23f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/28-12:51:20.059 23f0 Recovering log #3.2024/08/28-12:51:20.060 23f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1222240500024472
Encrypted:	false
SSDEEP:	384:b2qOB1nxCk4SAELyKOMq+8yC8F/YfU5m+OlT:Kq+n0T9ELyKOMq+8y9/Ow
MD5:	4C36DCC8AAC52900D7F76DC266CC4FC9
SHA1:	E97CC4BE0502001BA5AD8C388775A7DF3C3DC700
SHA-256:	1A440FA56082AC803D9114A78E4C762A8980B5DB0E9DEF881BC6D49B162D3131
SHA-512:	E7963D675D1776D20FFF1DF5DB1B668432BAA513A75A300AF83D0A7570FA68648AF570CCFBB8B02F11DF16D45F48C5B7C8A5576E99E32CB28AB930FC47BF8C8D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a56fd82e-6406-4b88-a5ae-6dbe325b3de6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\af5b3585-1b06-43d3-a060-01d3664c698b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b5503b36-523b-4ee4-aaaa-08867ed38e3e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24691
Entropy (8bit):	5.568343817984221
Encrypted:	false
SSDEEP:	768:UfS6etWPpEfu18F1+UoAYDCx9Tuqh0VfUC9xbog/OVMFksFrwjpMtuP:UfS6etWPpEfu1u1jaZusuqtg
MD5:	2E18DD1FA54E18AE06510A5A6C1D96B1
SHA1:	E0B38618720FD11FC638B09E83C48B769F857F1C
SHA-256:	6B6915A4756D9A1F55A253285C9A11577451A04FAB291AEAD75AAC718B766A14
SHA-512:	E21BC12C50BE020F08B718049868D91D355F6B8EA46732CAF222707A3FBF8D1BB17E1ADA81DB64140286B564A294BF9D1BEE7E9FE6B3B5DCA28B4B771C361708
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369337480101549","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369337480101549","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 8, database pages 11, cookie 0x7, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.4108834313259155
Encrypted:	false
SSDEEP:	24:TSWUYP5/ZrK/AxH1Aj5sAFWZmasamfDsCBjy8e+ZcI5fc:TnUYVAKAFXX+CcEc
MD5:	8593795778EA3EC8221366AA2FBBA867
SHA1:	2F307D4925183EA13E7BE637CB93ECAF2BA9810A
SHA-256:	F3C17873660988454A5A403D047FCE88379D1FE8917A89C98E6EB940F8929C03
SHA-512:	CC86DD61ACEDA6F2927C4C23CBD6D426F2C8CD1DF65E342C76D07153ACBF801F9B297F8EF182097CBABBDE6A49C90AF0E7A38E49AB53DF3FD2EC2D5BC675099A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................?.P................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.049731726990245535
Encrypted:	false
SSDEEP:	6:Gd0JAmu8jH0JAmu8rtCL9XCChslotGLNl0ml/XoQDeX:zJXsJXQpEjVl/XoQ
MD5:	C54B3D1870E84B11D259971CBC7B34F7
SHA1:	5F3D7D108711BA075CC8DFD4A079363B4F36DADB
SHA-256:	AC3A97348BF70C13B6BA0618708EE0F39FCA5644BAC0D2CD12CD9B5647D18F15
SHA-512:	4A0033E46E0309DC121922D795DC011FF830BA85FA02681A80C1FC1F145820526C328980034B21F20DFE4F83FA15F8D9D7FBB6F85024A614021E73AD24CFEFAD
Malicious:	false
Preview:	..-.....................:Db.W.v..4..}..tT...l...-.....................:Db.W.v..4..}..tT...l.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.190963327578523
Encrypted:	false
SSDEEP:	6:NHBdnkq2P923oH+TcwtfrK+IFUt88HBdnFZmw+8HBd7AkwO923oH+TcwtfrUeLJ:NHQv4Yeb23FUt88Hx/+8HQ5LYeb3J
MD5:	CC3C71B6373AB12CA890F7143FF8C651
SHA1:	6E672FB5A71B0EE61236DC461CDD61DD820C0DBA
SHA-256:	DFA842D443DCA578B35CE80795017AB890703B484C7E2B3A11A5BBC82D181B80
SHA-512:	3A1907D3201ED0A0FDC7DC080E167A743C0483986EFFFFDBD8AB93DC2B258FBA42AA90AE7E9598508AC12BAD1E3695EF5988D29AF06AC552263B81DC864BA345
Malicious:	false
Preview:	2024/08/28-12:51:20.393 23f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/08/28-12:51:20.393 23f0 Recovering log #3.2024/08/28-12:51:20.394 23f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.190963327578523
Encrypted:	false
SSDEEP:	6:NHBdnkq2P923oH+TcwtfrK+IFUt88HBdnFZmw+8HBd7AkwO923oH+TcwtfrUeLJ:NHQv4Yeb23FUt88Hx/+8HQ5LYeb3J
MD5:	CC3C71B6373AB12CA890F7143FF8C651
SHA1:	6E672FB5A71B0EE61236DC461CDD61DD820C0DBA
SHA-256:	DFA842D443DCA578B35CE80795017AB890703B484C7E2B3A11A5BBC82D181B80
SHA-512:	3A1907D3201ED0A0FDC7DC080E167A743C0483986EFFFFDBD8AB93DC2B258FBA42AA90AE7E9598508AC12BAD1E3695EF5988D29AF06AC552263B81DC864BA345
Malicious:	false
Preview:	2024/08/28-12:51:20.393 23f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/08/28-12:51:20.393 23f0 Recovering log #3.2024/08/28-12:51:20.394 23f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old~RF38ea5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.190963327578523
Encrypted:	false
SSDEEP:	6:NHBdnkq2P923oH+TcwtfrK+IFUt88HBdnFZmw+8HBd7AkwO923oH+TcwtfrUeLJ:NHQv4Yeb23FUt88Hx/+8HQ5LYeb3J
MD5:	CC3C71B6373AB12CA890F7143FF8C651
SHA1:	6E672FB5A71B0EE61236DC461CDD61DD820C0DBA
SHA-256:	DFA842D443DCA578B35CE80795017AB890703B484C7E2B3A11A5BBC82D181B80
SHA-512:	3A1907D3201ED0A0FDC7DC080E167A743C0483986EFFFFDBD8AB93DC2B258FBA42AA90AE7E9598508AC12BAD1E3695EF5988D29AF06AC552263B81DC864BA345
Malicious:	false
Preview:	2024/08/28-12:51:20.393 23f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/08/28-12:51:20.393 23f0 Recovering log #3.2024/08/28-12:51:20.394 23f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.172602588317597
Encrypted:	false
SSDEEP:	6:NHBdYq2P923oH+TcwtfrzAdIFUt88HBdYFZmw+8HBdYXkwO923oH+TcwtfrzILJ:NHkv4Yeb9FUt88HMF/+8HMX5LYeb2J
MD5:	25D8CE0C6DD4A38D3A646751B12E8BD0
SHA1:	57E5FA8C43FC7BC1D97AC6C75E619FE462AF2102
SHA-256:	69EC60A72AE4E4B09CA5E201F3D4CDD33FFEFB6AC09D765B1A25E778BF71EDEC
SHA-512:	83C924F31FEA185A8B0F0936675242F179AE77FB3A7F5DAD75A5B8F0B1D3C491A689F66F8346AFA99EFEAA4AC1C57E85DD2D5543C790FA7BDA5DF4E5B94F0D14
Malicious:	false
Preview:	2024/08/28-12:51:20.388 23f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/08/28-12:51:20.389 23f0 Recovering log #3.2024/08/28-12:51:20.389 23f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.172602588317597
Encrypted:	false
SSDEEP:	6:NHBdYq2P923oH+TcwtfrzAdIFUt88HBdYFZmw+8HBdYXkwO923oH+TcwtfrzILJ:NHkv4Yeb9FUt88HMF/+8HMX5LYeb2J
MD5:	25D8CE0C6DD4A38D3A646751B12E8BD0
SHA1:	57E5FA8C43FC7BC1D97AC6C75E619FE462AF2102
SHA-256:	69EC60A72AE4E4B09CA5E201F3D4CDD33FFEFB6AC09D765B1A25E778BF71EDEC
SHA-512:	83C924F31FEA185A8B0F0936675242F179AE77FB3A7F5DAD75A5B8F0B1D3C491A689F66F8346AFA99EFEAA4AC1C57E85DD2D5543C790FA7BDA5DF4E5B94F0D14
Malicious:	false
Preview:	2024/08/28-12:51:20.388 23f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/08/28-12:51:20.389 23f0 Recovering log #3.2024/08/28-12:51:20.389 23f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old~RF38ea5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.172602588317597
Encrypted:	false
SSDEEP:	6:NHBdYq2P923oH+TcwtfrzAdIFUt88HBdYFZmw+8HBdYXkwO923oH+TcwtfrzILJ:NHkv4Yeb9FUt88HMF/+8HMX5LYeb2J
MD5:	25D8CE0C6DD4A38D3A646751B12E8BD0
SHA1:	57E5FA8C43FC7BC1D97AC6C75E619FE462AF2102
SHA-256:	69EC60A72AE4E4B09CA5E201F3D4CDD33FFEFB6AC09D765B1A25E778BF71EDEC
SHA-512:	83C924F31FEA185A8B0F0936675242F179AE77FB3A7F5DAD75A5B8F0B1D3C491A689F66F8346AFA99EFEAA4AC1C57E85DD2D5543C790FA7BDA5DF4E5B94F0D14
Malicious:	false
Preview:	2024/08/28-12:51:20.388 23f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/08/28-12:51:20.389 23f0 Recovering log #3.2024/08/28-12:51:20.389 23f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907570806173945
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Xtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEV6Gtbz8hu3VlXr4CRo1
MD5:	2404F6BC473FB23B2B33898B89DEA0CE
SHA1:	7678A4195D489BACFF4062133F9FF254ABA7D963
SHA-256:	E8CD7FB927C9D62F734B22C932AAB274A76A78BEB3C093E8C6220035EC0A54F3
SHA-512:	D0F985E95A575334306FB68873A37209A3189738C5F83DC310717272D35FCD2655B9AC63E2E52CCDFCD50F0BE3F54681B5C50FDAE34E898E3EEC9896E18ECEE7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36f26.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907570806173945
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Xtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEV6Gtbz8hu3VlXr4CRo1
MD5:	2404F6BC473FB23B2B33898B89DEA0CE
SHA1:	7678A4195D489BACFF4062133F9FF254ABA7D963
SHA-256:	E8CD7FB927C9D62F734B22C932AAB274A76A78BEB3C093E8C6220035EC0A54F3
SHA-512:	D0F985E95A575334306FB68873A37209A3189738C5F83DC310717272D35FCD2655B9AC63E2E52CCDFCD50F0BE3F54681B5C50FDAE34E898E3EEC9896E18ECEE7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3707e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907570806173945
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Xtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEV6Gtbz8hu3VlXr4CRo1
MD5:	2404F6BC473FB23B2B33898B89DEA0CE
SHA1:	7678A4195D489BACFF4062133F9FF254ABA7D963
SHA-256:	E8CD7FB927C9D62F734B22C932AAB274A76A78BEB3C093E8C6220035EC0A54F3
SHA-512:	D0F985E95A575334306FB68873A37209A3189738C5F83DC310717272D35FCD2655B9AC63E2E52CCDFCD50F0BE3F54681B5C50FDAE34E898E3EEC9896E18ECEE7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF372a1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907570806173945
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Xtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEV6Gtbz8hu3VlXr4CRo1
MD5:	2404F6BC473FB23B2B33898B89DEA0CE
SHA1:	7678A4195D489BACFF4062133F9FF254ABA7D963
SHA-256:	E8CD7FB927C9D62F734B22C932AAB274A76A78BEB3C093E8C6220035EC0A54F3
SHA-512:	D0F985E95A575334306FB68873A37209A3189738C5F83DC310717272D35FCD2655B9AC63E2E52CCDFCD50F0BE3F54681B5C50FDAE34E898E3EEC9896E18ECEE7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38e85.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907570806173945
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Xtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEV6Gtbz8hu3VlXr4CRo1
MD5:	2404F6BC473FB23B2B33898B89DEA0CE
SHA1:	7678A4195D489BACFF4062133F9FF254ABA7D963
SHA-256:	E8CD7FB927C9D62F734B22C932AAB274A76A78BEB3C093E8C6220035EC0A54F3
SHA-512:	D0F985E95A575334306FB68873A37209A3189738C5F83DC310717272D35FCD2655B9AC63E2E52CCDFCD50F0BE3F54681B5C50FDAE34E898E3EEC9896E18ECEE7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38ee3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907570806173945
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Xtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEV6Gtbz8hu3VlXr4CRo1
MD5:	2404F6BC473FB23B2B33898B89DEA0CE
SHA1:	7678A4195D489BACFF4062133F9FF254ABA7D963
SHA-256:	E8CD7FB927C9D62F734B22C932AAB274A76A78BEB3C093E8C6220035EC0A54F3
SHA-512:	D0F985E95A575334306FB68873A37209A3189738C5F83DC310717272D35FCD2655B9AC63E2E52CCDFCD50F0BE3F54681B5C50FDAE34E898E3EEC9896E18ECEE7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38f22.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0907570806173945
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Xtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEV6Gtbz8hu3VlXr4CRo1
MD5:	2404F6BC473FB23B2B33898B89DEA0CE
SHA1:	7678A4195D489BACFF4062133F9FF254ABA7D963
SHA-256:	E8CD7FB927C9D62F734B22C932AAB274A76A78BEB3C093E8C6220035EC0A54F3
SHA-512:	D0F985E95A575334306FB68873A37209A3189738C5F83DC310717272D35FCD2655B9AC63E2E52CCDFCD50F0BE3F54681B5C50FDAE34E898E3EEC9896E18ECEE7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	270336
Entropy (8bit):	0.0018238520723782249
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zET:/M/xT02z8
MD5:	AC81EF9540AC3DDCC4546B82AC3801BD
SHA1:	1AC27855FABFA8AF62752DA91E2A6EADC815CBBC
SHA-256:	4A2C8BA05BE86A2182B9BCC9AEC916588CC9502F4F505CD79991AF8326EC11E4
SHA-512:	D27635D446F0AEA20E138F96BEDEDF118CCF0BC8560CB2E11AB0AACE9D320E989164E2971DAB20571A9B6D9A1B4A52CAAF78084D2141372D77516F52ABD222AB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQw:YQ3Kq9X0dMgAEiLI2
MD5:	265DB1C9337422F9AF69EF2B4E1C7205
SHA1:	3E38976BB5CF035C75C9BC185F72A80E70F41C2E
SHA-256:	7CA5A3CCC077698CA62AC8157676814B3D8E93586364D0318987E37B4F8590BC
SHA-512:	3CC9B76D8D4B6EDB4C41677BE3483AC37785F3BBFEA4489F3855433EBF84EA25FC48EFEE9B74CAB268DC9CB7FB4789A81C94E75C7BF723721DE28AEF53D8B529
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a0019422-7c3e-40de-b273-e24fa375d175.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44665
Entropy (8bit):	6.096396091702185
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBlFuIhDO6vP6Oushb3OgzNNGPHAlEp0IcGoup1XlI:z/Ps+wsI7yOEk67hrXmchu3VlXr4CRo1
MD5:	C84050817615639E1D62080B8AE7788B
SHA1:	E906DCC72B79AD35869113B3EED18E9D241352C7
SHA-256:	3D20FF03FBD72AA938F219C0B74D3FEC5FA1E1281101DDC1A5602CDF44B7DD7F
SHA-512:	AF6F9B1924374F131ECA17B36D16E6944FB9DB140AC93C81A88FC7A3FE7AAD1489EFD1F677A4631ACC411B39970AABF7DFACB45DA0CBADAC4BEAB4B40E8C7C3C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.841220312678394
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxXxl9Il8uN2X7llZLpT6mfBvdqTjQhDd1rc:meYbs7ljh6mfpaz
MD5:	57441116BFB45D7C3FB6690EE2AF30AB
SHA1:	7DA73BE6748BEFB196DF6FA0E69EBC13E7AB795D
SHA-256:	867DF90ECEF0491B28A8895A0DA677CBFD038449E2483EC236E424166D9A63B9
SHA-512:	4A85442CEE50B3A36EA2D66CE8ACFC39CEFB9E4E9364C675D9707EF751A79F7FCADCF4CE87F8E243A51A92E4D1737F5ABA843477B0D24A67754C2F47AA6BD619
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.I.q.a.2.n.L.5.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.u.Y.I.g.B.D.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.005080307210047
Encrypted:	false
SSDEEP:	96:5YbyfXZ228+zCeu7mPtC0J8xyDYabTmYU9H:5DxJzCeTt8xJabTmYU9H
MD5:	5B7107CF48D3E6A60568A63260E963A3
SHA1:	E118DD7FD74FBE75DC8749A94286E203FB2A81D0
SHA-256:	E28D27FF01F5C66A26A2F24B03E7A595C434733A14371F78FAB063EC55618BFE
SHA-512:	27EE345815E3D298352BB3E2E1F8BCB20E04D4C391CC2F362F571F41BF7AA3D68CE6F19BD88086A8B48DFEA55DC563FDDEED5E9106E2DE183974648D01FEBE9F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".h.i.q.l.w.G.r.5.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.u.Y.I.g.B.D.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	5.395589324420336
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rr0:8e2Fa116uCntc5toY0
MD5:	E6E32DE078FFFC3B9C78B94BC3DA3028
SHA1:	438D39BCE4A81DAB45D078526F6D8208EB3D131F
SHA-256:	9C796B956F9020E7188005935A81155A1AAC7544E7F0DA50FE78436077E08A3C
SHA-512:	EF5B51AE16B893FD501D00DBF64F9B9074E0658A6AAD0159A6CF7958EC6322E8C1F0BA2A34430AE917A58A6193DA82F49A2C64256896BDFFD1180524A8A33F8F
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.513846187404551
Encrypted:	false
SSDEEP:	48:ERE2a3dOMcI+JsJGr3zBdLXuHTkDpyR2A8xcZdOMcOJsJGr3zngdLXuHTk+21:EhW/u3uzkDgsNeFnIuzkz
MD5:	1BEAB2C74F022E342C065DC3A07AE5D9
SHA1:	CDB35050D7A1913F552100C724F339E546A12971
SHA-256:	874F117995BA1EB6CFB1277B300BBE7F738FF5B33F53913AB2A85726B4DC1F98
SHA-512:	101AC0A0233D2E62D4A5F0ABDDB7A99EE6DAD0F9FC35E378930ABEA5083F5B010A3A9B2C9F5C78DB41489F9BD34F9A117CB3E88FB98A1991D6EB9171931A09BB
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....n.yj....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DW r..PROGRA~2.........O.IDW r....................V.......B.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DW r..MICROS~1..D......(Ux..Yb...........................h.}.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DWUl...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Ya...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Ya.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........Q........C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9DZLDA8PIDG8DHKXL1NV.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5171634965175653
Encrypted:	false
SSDEEP:	48:nE8xcZdOMcOJsJGr3zBdLXuHTkDpp2A8xcZdOMcOJsJGr3zngdLXuHTk+21:ReF3uzkDyNeFnIuzkz
MD5:	DF6C24861FB6269A5B226011D0AB9E46
SHA1:	472051140B9F397C0EDCFF7D4309B02F7CFF3068
SHA-256:	2CFF280074087D929701D3CED61694E61C13313C84720C658E56C959A188BC9F
SHA-512:	50A01E32E9E86E0FB36C31C2E77BD1BC8B0B85E79D43F70F187820C4E0AAB3CA84CB527FFB556B1C66827BFF24ECEC1E6B48FD3F896D6737797894AA1B5F8860
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......yj....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y]...PROGRA~2.........O.I.Y].....................V......4..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DW r..MICROS~1..D......(Ux..Yb...........................h.}.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Yd............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Ya...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Ya.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........Q........C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CP17CL0CBT7LLMOOPWDQ.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.513846187404551
Encrypted:	false
SSDEEP:	48:ERE2a3dOMcI+JsJGr3zBdLXuHTkDpyR2A8xcZdOMcOJsJGr3zngdLXuHTk+21:EhW/u3uzkDgsNeFnIuzkz
MD5:	1BEAB2C74F022E342C065DC3A07AE5D9
SHA1:	CDB35050D7A1913F552100C724F339E546A12971
SHA-256:	874F117995BA1EB6CFB1277B300BBE7F738FF5B33F53913AB2A85726B4DC1F98
SHA-512:	101AC0A0233D2E62D4A5F0ABDDB7A99EE6DAD0F9FC35E378930ABEA5083F5B010A3A9B2C9F5C78DB41489F9BD34F9A117CB3E88FB98A1991D6EB9171931A09BB
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....n.yj....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DW r..PROGRA~2.........O.IDW r....................V.......B.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DW r..MICROS~1..D......(Ux..Yb...........................h.}.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DWUl...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Ya...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Ya.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........Q........C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5171634965175653
Encrypted:	false
SSDEEP:	48:nE8xcZdOMcOJsJGr3zBdLXuHTkDpp2A8xcZdOMcOJsJGr3zngdLXuHTk+21:ReF3uzkDyNeFnIuzkz
MD5:	DF6C24861FB6269A5B226011D0AB9E46
SHA1:	472051140B9F397C0EDCFF7D4309B02F7CFF3068
SHA-256:	2CFF280074087D929701D3CED61694E61C13313C84720C658E56C959A188BC9F
SHA-512:	50A01E32E9E86E0FB36C31C2E77BD1BC8B0B85E79D43F70F187820C4E0AAB3CA84CB527FFB556B1C66827BFF24ECEC1E6B48FD3F896D6737797894AA1B5F8860
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......yj....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y]...PROGRA~2.........O.I.Y].....................V......4..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DW r..MICROS~1..D......(Ux..Yb...........................h.}.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Yd............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Ya...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Ya.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........Q........C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5797731274031
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	dc12b6f6672fb5207663bdc61e10f8aa
SHA1:	d5c078b706871bc9ad4a7fbb1557ada47c818b95
SHA256:	1ab5b718a73e9f1b5025ab9b1ce5cee5bb3d5773777f3cf65ba0ef824cfe0925
SHA512:	23891bded905aabad807d5c9c55fbe26cf5e1c9bc6adfec9f269a837d621366591c58dd4dbe9396bc63b19565ed34499765b2ca743932d7041eb2fef79fa8390
SSDEEP:	12288:iqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTO:iqDEvCTbMWu7rQYlBQcBiT6rprG8asO
TLSH:	69159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CF54D4 [Wed Aug 28 16:48:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FD47490F883h
jmp 00007FD47490F18Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FD47490F36Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FD47490F33Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FD474911F2Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FD474911F78h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FD474911F61h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	da213db2b75b473fa6f5aae572be1990	False	0.28692708333333333	data	5.165368038293032	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 18:50:57.616569996 CEST	49674	443	192.168.2.5	23.1.237.91
Aug 28, 2024 18:50:57.616570950 CEST	49675	443	192.168.2.5	23.1.237.91
Aug 28, 2024 18:50:57.725924015 CEST	49673	443	192.168.2.5	23.1.237.91
Aug 28, 2024 18:51:07.243905067 CEST	49674	443	192.168.2.5	23.1.237.91
Aug 28, 2024 18:51:07.337698936 CEST	49675	443	192.168.2.5	23.1.237.91
Aug 28, 2024 18:51:07.337712049 CEST	49673	443	192.168.2.5	23.1.237.91
Aug 28, 2024 18:51:07.994242907 CEST	49721	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:07.994286060 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:07.994570017 CEST	49721	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:07.997121096 CEST	49721	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:07.997138977 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.044621944 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.044636011 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.044704914 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.044883966 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.044893980 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.760083914 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.760461092 CEST	49721	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.760484934 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.761573076 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.761651993 CEST	49721	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.762454987 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.763590097 CEST	49721	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.763654947 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.763775110 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.763782024 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.764038086 CEST	49721	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.764045000 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.764878035 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.764970064 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.766645908 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.766716003 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.767108917 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.767115116 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.864077091 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.864088058 CEST	49721	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.864917994 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.864948988 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.864957094 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.864981890 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.864995956 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.865010023 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.865046024 CEST	49721	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.865056038 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.865075111 CEST	49721	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.865674019 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.865757942 CEST	49721	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.871160030 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.871179104 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.871191025 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.871211052 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.871216059 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.871222019 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.871244907 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.871251106 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.871294022 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.871336937 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.960870981 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.960882902 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.960911989 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.960972071 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.960980892 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.961000919 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.961025000 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.962939024 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.962958097 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.963023901 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.963032961 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:08.963067055 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.963105917 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:08.967550993 CEST	443	49703	23.1.237.91	192.168.2.5
Aug 28, 2024 18:51:08.967654943 CEST	49703	443	192.168.2.5	23.1.237.91
Aug 28, 2024 18:51:09.022255898 CEST	49721	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:09.022296906 CEST	443	49721	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:09.050518990 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:09.050548077 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:09.050621986 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:09.050630093 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:09.050689936 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:09.050698996 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:09.051217079 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:09.051285028 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:09.051290035 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:09.051301003 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:09.051348925 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:09.052277088 CEST	49723	443	192.168.2.5	13.107.246.60
Aug 28, 2024 18:51:09.052287102 CEST	443	49723	13.107.246.60	192.168.2.5
Aug 28, 2024 18:51:09.297835112 CEST	49724	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.297863960 CEST	443	49724	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.298013926 CEST	49724	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.298542023 CEST	49724	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.298552036 CEST	443	49724	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.299396038 CEST	49725	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.299405098 CEST	443	49725	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.299488068 CEST	49725	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.299676895 CEST	49726	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.299714088 CEST	443	49726	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.299941063 CEST	49727	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.299948931 CEST	443	49727	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.299977064 CEST	49726	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.300003052 CEST	49727	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.300198078 CEST	49725	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.300208092 CEST	443	49725	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.300378084 CEST	49727	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.300393105 CEST	443	49727	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.300540924 CEST	49726	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.300548077 CEST	443	49726	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.381258011 CEST	49728	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.381304026 CEST	443	49728	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.381390095 CEST	49728	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.382565975 CEST	49728	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.382580996 CEST	443	49728	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.766879082 CEST	443	49724	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.767163992 CEST	49724	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.767177105 CEST	443	49724	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.768241882 CEST	443	49724	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.768313885 CEST	49724	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.769552946 CEST	49724	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.769591093 CEST	443	49727	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.769633055 CEST	443	49724	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.769913912 CEST	49727	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.769938946 CEST	443	49727	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.769987106 CEST	443	49725	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.770073891 CEST	49724	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.770082951 CEST	443	49724	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.770210981 CEST	49725	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.770220041 CEST	443	49725	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.770369053 CEST	443	49726	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.770598888 CEST	49726	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.770608902 CEST	443	49726	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.771207094 CEST	443	49727	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.771270990 CEST	49727	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.771295071 CEST	443	49725	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.771353006 CEST	49725	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.771908045 CEST	443	49726	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.771984100 CEST	49726	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.772320032 CEST	49727	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.772387981 CEST	443	49727	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.772944927 CEST	49725	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.773013115 CEST	443	49725	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.773403883 CEST	49727	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.773412943 CEST	443	49727	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.773490906 CEST	49726	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.773567915 CEST	443	49726	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.773653030 CEST	49725	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.773662090 CEST	443	49725	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.773700953 CEST	49726	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.773709059 CEST	443	49726	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.821749926 CEST	49724	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.821926117 CEST	49726	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.852124929 CEST	443	49728	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.852413893 CEST	49728	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.852442980 CEST	443	49728	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.853535891 CEST	443	49728	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.853602886 CEST	49728	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.856005907 CEST	49728	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.856085062 CEST	443	49728	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.856297016 CEST	49728	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.856306076 CEST	443	49728	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.887433052 CEST	443	49726	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.887496948 CEST	443	49726	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.887645960 CEST	49726	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.887758017 CEST	49726	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.887774944 CEST	443	49726	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.889239073 CEST	443	49727	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.889312029 CEST	49727	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.889484882 CEST	49727	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.889489889 CEST	443	49727	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.890162945 CEST	443	49725	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.890222073 CEST	49725	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.890393972 CEST	49725	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.890407085 CEST	443	49725	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.900521040 CEST	443	49724	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.900612116 CEST	443	49724	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.900680065 CEST	49724	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.900831938 CEST	49724	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:09.900840998 CEST	443	49724	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:09.947424889 CEST	49728	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.971421957 CEST	49734	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:09.971463919 CEST	443	49734	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:09.971564054 CEST	49734	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:09.981188059 CEST	49734	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:09.981205940 CEST	443	49734	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:09.983632088 CEST	443	49728	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.983700037 CEST	443	49728	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:09.983764887 CEST	49728	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.984132051 CEST	49728	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:51:09.984152079 CEST	443	49728	172.64.41.3	192.168.2.5
Aug 28, 2024 18:51:10.657826900 CEST	443	49734	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:10.657898903 CEST	49734	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:10.714147091 CEST	49734	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:10.714173079 CEST	443	49734	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:10.714572906 CEST	443	49734	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:10.759705067 CEST	49734	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:10.780500889 CEST	49734	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:10.828497887 CEST	443	49734	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:10.972140074 CEST	443	49734	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:10.972212076 CEST	443	49734	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:10.972300053 CEST	49734	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:10.972423077 CEST	49734	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:10.972440004 CEST	443	49734	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:10.972455025 CEST	49734	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:10.972460032 CEST	443	49734	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:11.026618004 CEST	49735	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:11.026667118 CEST	443	49735	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:11.026801109 CEST	49735	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:11.027668953 CEST	49735	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:11.027690887 CEST	443	49735	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:11.521549940 CEST	49736	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.521595955 CEST	443	49736	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.521692038 CEST	49736	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.522187948 CEST	49737	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.522223949 CEST	443	49737	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.522409916 CEST	49736	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.522427082 CEST	443	49736	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.522433043 CEST	49737	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.522799015 CEST	49737	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.522813082 CEST	443	49737	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.681976080 CEST	443	49735	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:11.682115078 CEST	49735	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:11.718764067 CEST	49735	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:11.718802929 CEST	443	49735	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:11.719099045 CEST	443	49735	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:11.720135927 CEST	49735	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:11.760508060 CEST	443	49735	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:11.958153963 CEST	443	49735	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:11.958233118 CEST	443	49735	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:11.958323956 CEST	49735	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:11.959844112 CEST	49735	443	192.168.2.5	184.28.90.27
Aug 28, 2024 18:51:11.959870100 CEST	443	49735	184.28.90.27	192.168.2.5
Aug 28, 2024 18:51:12.004452944 CEST	443	49736	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.010148048 CEST	49736	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:12.010165930 CEST	443	49736	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.010586977 CEST	443	49736	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.013451099 CEST	49736	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:12.013535023 CEST	443	49736	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.034226894 CEST	443	49737	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.061697006 CEST	49736	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:12.076800108 CEST	49737	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:12.125989914 CEST	49737	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:12.126015902 CEST	443	49737	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.126540899 CEST	443	49737	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.128438950 CEST	49738	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.128487110 CEST	443	49738	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.128578901 CEST	49738	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.157871962 CEST	49739	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.157922983 CEST	443	49739	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.158001900 CEST	49739	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.159027100 CEST	49737	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:12.159146070 CEST	443	49737	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.159605026 CEST	49738	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.159625053 CEST	443	49738	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.160495996 CEST	49739	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.160507917 CEST	443	49739	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.202653885 CEST	49737	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:12.486218929 CEST	49740	443	192.168.2.5	142.251.40.228
Aug 28, 2024 18:51:12.486247063 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:12.486320972 CEST	49740	443	192.168.2.5	142.251.40.228
Aug 28, 2024 18:51:12.486531973 CEST	49740	443	192.168.2.5	142.251.40.228
Aug 28, 2024 18:51:12.486550093 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:12.649812937 CEST	443	49738	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.650648117 CEST	49738	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.650661945 CEST	443	49738	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.651074886 CEST	443	49738	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.651145935 CEST	49738	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.651783943 CEST	443	49739	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.651864052 CEST	443	49738	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.651935101 CEST	49738	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.653666973 CEST	49739	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.653687000 CEST	443	49739	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.653960943 CEST	49738	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.654027939 CEST	443	49738	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.654217958 CEST	443	49739	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.654278994 CEST	49739	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.654825926 CEST	49738	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.654839039 CEST	443	49738	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.654948950 CEST	443	49739	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.655004025 CEST	49739	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.656862974 CEST	49739	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.656946898 CEST	443	49739	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.657150984 CEST	49739	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.657157898 CEST	443	49739	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.700062990 CEST	49739	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.700299025 CEST	49738	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.829246998 CEST	443	49739	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.830248117 CEST	49739	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.830313921 CEST	443	49739	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.830377102 CEST	49739	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.835839033 CEST	443	49738	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.835920095 CEST	443	49738	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.836000919 CEST	49738	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.836817980 CEST	49738	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:12.836837053 CEST	443	49738	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:12.952361107 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:12.953084946 CEST	49740	443	192.168.2.5	142.251.40.228
Aug 28, 2024 18:51:12.953099966 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:12.954803944 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:12.954866886 CEST	49740	443	192.168.2.5	142.251.40.228
Aug 28, 2024 18:51:12.956607103 CEST	49740	443	192.168.2.5	142.251.40.228
Aug 28, 2024 18:51:12.956688881 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:12.956832886 CEST	49740	443	192.168.2.5	142.251.40.228
Aug 28, 2024 18:51:12.996340036 CEST	49740	443	192.168.2.5	142.251.40.228
Aug 28, 2024 18:51:12.996356010 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:13.042887926 CEST	49740	443	192.168.2.5	142.251.40.228
Aug 28, 2024 18:51:13.051641941 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:13.051691055 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:13.051727057 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:13.051759005 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:13.051779985 CEST	49740	443	192.168.2.5	142.251.40.228
Aug 28, 2024 18:51:13.051789045 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:13.051846027 CEST	49740	443	192.168.2.5	142.251.40.228
Aug 28, 2024 18:51:13.051856041 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:13.051873922 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:13.051928997 CEST	49740	443	192.168.2.5	142.251.40.228
Aug 28, 2024 18:51:13.052947044 CEST	49740	443	192.168.2.5	142.251.40.228
Aug 28, 2024 18:51:13.052962065 CEST	443	49740	142.251.40.228	192.168.2.5
Aug 28, 2024 18:51:13.155024052 CEST	49741	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.155098915 CEST	443	49741	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.155324936 CEST	49741	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.173774958 CEST	49742	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.173790932 CEST	443	49742	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.173916101 CEST	49742	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.174457073 CEST	49741	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.174474001 CEST	443	49741	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.174973965 CEST	49742	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.174981117 CEST	443	49742	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.646214962 CEST	443	49741	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.652388096 CEST	49741	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.652405977 CEST	443	49741	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.652980089 CEST	443	49741	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.653050900 CEST	49741	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.653712988 CEST	443	49741	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.653783083 CEST	49741	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.657934904 CEST	49741	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.658003092 CEST	443	49741	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.658154011 CEST	443	49742	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.658570051 CEST	49742	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.658576965 CEST	443	49742	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.658941031 CEST	443	49742	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.658998013 CEST	49742	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.659672022 CEST	443	49742	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.659724951 CEST	49742	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.662548065 CEST	49742	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.662607908 CEST	443	49742	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.712774038 CEST	49741	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.712796926 CEST	443	49741	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.712810993 CEST	49742	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.712817907 CEST	443	49742	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.754230976 CEST	49742	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.759646893 CEST	49741	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:17.764708042 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:17.764753103 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:17.764843941 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:17.765950918 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:17.765964031 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:18.556468964 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:18.556587934 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:18.558871984 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:18.558881998 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:18.559182882 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:18.603194952 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:19.285068035 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:19.332514048 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:19.546742916 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:19.546772957 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:19.546781063 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:19.546791077 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:19.546813011 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:19.546850920 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:19.546879053 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:19.546902895 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:19.546933889 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:19.547120094 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:19.547175884 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:19.547180891 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:19.547194958 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:19.547261000 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:20.950779915 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:20.950814009 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:20.950856924 CEST	49743	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:20.950864077 CEST	443	49743	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:26.917001009 CEST	443	49736	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:26.917073965 CEST	443	49736	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:26.917124987 CEST	49736	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:26.934043884 CEST	443	49737	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:26.934123039 CEST	443	49737	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:26.934295893 CEST	49737	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:58.515768051 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:58.515820026 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:58.515907049 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:58.516345024 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:58.516356945 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:58.713148117 CEST	49742	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:58.713169098 CEST	443	49742	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:58.714129925 CEST	49741	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:58.714135885 CEST	443	49741	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:59.314589024 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:59.314728022 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:59.318622112 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:59.318629980 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:59.318990946 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:59.327657938 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:59.368499041 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:59.643129110 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:59.643160105 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:59.643182993 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:59.643284082 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:59.643301010 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:59.643354893 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:59.643354893 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:59.644236088 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:59.644287109 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:59.644366026 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:59.644366026 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:59.644372940 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:59.644615889 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:59.644685984 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:59.720015049 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:59.720036030 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:51:59.720062017 CEST	49750	443	192.168.2.5	40.127.169.103
Aug 28, 2024 18:51:59.720068932 CEST	443	49750	40.127.169.103	192.168.2.5
Aug 28, 2024 18:52:03.389964104 CEST	49751	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.389990091 CEST	443	49751	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.390043974 CEST	49751	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.390363932 CEST	49752	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.390371084 CEST	443	49752	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.390424967 CEST	49752	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.390657902 CEST	49751	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.390671015 CEST	443	49751	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.390770912 CEST	49752	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.390782118 CEST	443	49752	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.852197886 CEST	443	49751	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.852545023 CEST	49751	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.852559090 CEST	443	49751	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.852885962 CEST	443	49751	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.856817007 CEST	49751	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.856877089 CEST	443	49751	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.865811110 CEST	443	49752	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.866008997 CEST	49752	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.866017103 CEST	443	49752	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.866329908 CEST	443	49752	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.866599083 CEST	49752	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.866656065 CEST	443	49752	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.900527954 CEST	49751	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.916189909 CEST	49752	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:11.931050062 CEST	49736	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:11.931090117 CEST	443	49736	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:11.946697950 CEST	49737	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:11.946724892 CEST	443	49737	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:18.784732103 CEST	443	49751	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:18.784817934 CEST	443	49751	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:18.784904003 CEST	49751	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:18.797508001 CEST	443	49752	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:18.797586918 CEST	443	49752	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:18.797665119 CEST	49752	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:43.713303089 CEST	49742	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:52:43.713330984 CEST	443	49742	142.250.80.46	192.168.2.5
Aug 28, 2024 18:52:43.728291988 CEST	49741	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:52:43.728310108 CEST	443	49741	142.250.80.46	192.168.2.5
Aug 28, 2024 18:52:56.931541920 CEST	49736	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:56.931585073 CEST	443	49736	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:56.947037935 CEST	49737	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:56.947058916 CEST	443	49737	162.159.61.3	192.168.2.5
Aug 28, 2024 18:53:03.792804003 CEST	49751	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:53:03.792828083 CEST	443	49751	172.64.41.3	192.168.2.5
Aug 28, 2024 18:53:03.807863951 CEST	49752	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:53:03.807874918 CEST	443	49752	172.64.41.3	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 18:51:04.927757978 CEST	53	61607	1.1.1.1	192.168.2.5
Aug 28, 2024 18:51:06.572402954 CEST	58005	53	192.168.2.5	1.1.1.1
Aug 28, 2024 18:51:06.572659016 CEST	52197	53	192.168.2.5	1.1.1.1
Aug 28, 2024 18:51:07.853586912 CEST	53	50606	1.1.1.1	192.168.2.5
Aug 28, 2024 18:51:07.866040945 CEST	53	58624	1.1.1.1	192.168.2.5
Aug 28, 2024 18:51:09.289952040 CEST	55041	53	192.168.2.5	1.1.1.1
Aug 28, 2024 18:51:09.290306091 CEST	62597	53	192.168.2.5	1.1.1.1
Aug 28, 2024 18:51:09.290643930 CEST	60759	53	192.168.2.5	1.1.1.1
Aug 28, 2024 18:51:09.290812969 CEST	57893	53	192.168.2.5	1.1.1.1
Aug 28, 2024 18:51:09.291130066 CEST	58973	53	192.168.2.5	1.1.1.1
Aug 28, 2024 18:51:09.291361094 CEST	49914	53	192.168.2.5	1.1.1.1
Aug 28, 2024 18:51:09.291711092 CEST	55062	53	192.168.2.5	1.1.1.1
Aug 28, 2024 18:51:09.291865110 CEST	49652	53	192.168.2.5	1.1.1.1
Aug 28, 2024 18:51:09.296762943 CEST	53	55041	1.1.1.1	192.168.2.5
Aug 28, 2024 18:51:09.297334909 CEST	53	62597	1.1.1.1	192.168.2.5
Aug 28, 2024 18:51:09.297847986 CEST	53	57893	1.1.1.1	192.168.2.5
Aug 28, 2024 18:51:09.298299074 CEST	53	58973	1.1.1.1	192.168.2.5
Aug 28, 2024 18:51:09.298659086 CEST	53	60759	1.1.1.1	192.168.2.5
Aug 28, 2024 18:51:09.299045086 CEST	53	49652	1.1.1.1	192.168.2.5
Aug 28, 2024 18:51:09.299122095 CEST	53	55062	1.1.1.1	192.168.2.5
Aug 28, 2024 18:51:09.299249887 CEST	53	49914	1.1.1.1	192.168.2.5
Aug 28, 2024 18:51:09.369601011 CEST	53557	53	192.168.2.5	1.1.1.1
Aug 28, 2024 18:51:09.369766951 CEST	59907	53	192.168.2.5	1.1.1.1
Aug 28, 2024 18:51:09.380534887 CEST	53	53557	1.1.1.1	192.168.2.5
Aug 28, 2024 18:51:09.380549908 CEST	53	59907	1.1.1.1	192.168.2.5
Aug 28, 2024 18:51:11.204803944 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.520890951 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.662808895 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.663407087 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.663458109 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.663469076 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.663486958 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.717638969 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.721712112 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.725423098 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.725548983 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.725960016 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.726104021 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.822648048 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.822668076 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.822673082 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.822676897 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.823566914 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.824290037 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.824474096 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.825294971 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.825750113 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.925230026 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:11.957645893 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.977149963 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:11.977538109 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:12.080295086 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.081020117 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.083941936 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.085401058 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.126456976 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:12.388453007 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:12.388601065 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:12.483556032 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.484957933 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.485306025 CEST	443	55262	162.159.61.3	192.168.2.5
Aug 28, 2024 18:51:12.485634089 CEST	55262	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:51:12.832324982 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.151499033 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.594850063 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.594867945 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.594880104 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.594999075 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.595010042 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.595022917 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.596035957 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.596247911 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.597093105 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.598193884 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.598655939 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.598922968 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.599427938 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.605743885 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.619323015 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.693077087 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.693325996 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.693336964 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.695877075 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.696193933 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.700263023 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.700822115 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.713424921 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.744527102 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:13.791465044 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.797394037 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.799271107 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:13.800654888 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:14.031409025 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:14.031663895 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:14.072823048 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:14.125133038 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:20.936928988 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:20.937387943 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:21.031292915 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:21.143026114 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:21.149873972 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:21.160093069 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:21.282282114 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:21.575737953 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:42.153507948 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:42.272919893 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:42.324626923 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:42.326522112 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:42.329880953 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:42.360341072 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:42.389750004 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:42.450326920 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:42.509702921 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:42.569513083 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:42.572906971 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:42.703007936 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:42.743736982 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:42.822726011 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:42.857301950 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:42.857362032 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:42.952888012 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:42.980089903 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:43.028304100 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:43.028749943 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:43.030081034 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:51:43.056931973 CEST	65500	443	192.168.2.5	142.250.80.46
Aug 28, 2024 18:51:43.148914099 CEST	443	65500	142.250.80.46	192.168.2.5
Aug 28, 2024 18:52:03.389714956 CEST	59199	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.697616100 CEST	59199	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.850768089 CEST	443	59199	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.850814104 CEST	443	59199	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.850828886 CEST	443	59199	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.850939035 CEST	443	59199	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.850994110 CEST	443	59199	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.851478100 CEST	59199	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.852616072 CEST	59199	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.853370905 CEST	59199	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.853491068 CEST	59199	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.857094049 CEST	59199	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.857217073 CEST	59199	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.947690964 CEST	443	59199	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.947988987 CEST	443	59199	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.948028088 CEST	443	59199	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.948226929 CEST	443	59199	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.955007076 CEST	443	59199	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.955126047 CEST	443	59199	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.955328941 CEST	443	59199	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:03.957675934 CEST	59199	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.957734108 CEST	59199	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:03.957884073 CEST	59199	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:04.057238102 CEST	443	59199	172.64.41.3	192.168.2.5
Aug 28, 2024 18:52:04.088732004 CEST	59199	443	192.168.2.5	172.64.41.3
Aug 28, 2024 18:52:10.924436092 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:10.924577951 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:10.924912930 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:10.925023079 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:11.416268110 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:11.654068947 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:11.684251070 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:11.712814093 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:11.750982046 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:11.750997066 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:11.751207113 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:11.751218081 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:11.752207994 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:11.755361080 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:11.755451918 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:11.784408092 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:11.853383064 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:11.864629984 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:11.947041988 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:11.947114944 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:11.947679996 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:11.955408096 CEST	53	56309	1.1.1.1	192.168.2.5
Aug 28, 2024 18:52:11.955935001 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:12.020560026 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:12.022397995 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:12.022783041 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:12.022958040 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:12.128576994 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:12.128659964 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:12.151210070 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:12.151510954 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:13.655577898 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:13.655746937 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:13.757185936 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:13.757858992 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:13.758466005 CEST	443	55076	162.159.61.3	192.168.2.5
Aug 28, 2024 18:52:13.758711100 CEST	55076	443	192.168.2.5	162.159.61.3
Aug 28, 2024 18:52:13.759589911 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:13.759757996 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:14.324251890 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:14.531951904 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:14.543015003 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:14.543339014 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:14.543569088 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:14.543652058 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:14.543872118 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:14.543889999 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:14.544076920 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:14.544076920 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:14.558284044 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:14.648972034 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:14.649384022 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:14.649614096 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:14.649646997 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:14.650597095 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:14.670958996 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:14.681802988 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:14.725613117 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:14.726084948 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:14.728336096 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:14.729829073 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:14.730067015 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:14.730289936 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:14.760504007 CEST	56408	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:14.833597898 CEST	443	56408	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:43.888541937 CEST	57022	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:43.888763905 CEST	57022	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:44.350346088 CEST	443	57022	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:44.351005077 CEST	57022	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:44.351341009 CEST	443	57022	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:44.351351023 CEST	57022	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:44.351363897 CEST	57022	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:44.365430117 CEST	443	57022	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:44.385195971 CEST	57022	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:44.444413900 CEST	443	57022	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:44.444971085 CEST	443	57022	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:44.445180893 CEST	57022	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:44.447380066 CEST	443	57022	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:44.522618055 CEST	443	57022	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:44.523051023 CEST	57022	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:44.524302006 CEST	443	57022	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:44.556648970 CEST	57022	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:44.574625969 CEST	57022	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:44.842303038 CEST	443	57022	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:44.842741013 CEST	443	57022	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:44.843067884 CEST	443	57022	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:44.843076944 CEST	443	57022	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:44.843266964 CEST	57022	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:44.869235039 CEST	57022	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:44.901971102 CEST	443	57022	142.251.40.238	192.168.2.5
Aug 28, 2024 18:52:44.902225018 CEST	57022	443	192.168.2.5	142.251.40.238
Aug 28, 2024 18:52:44.964643955 CEST	443	57022	142.251.40.238	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 28, 2024 18:51:06.572402954 CEST	192.168.2.5	1.1.1.1	0x7284	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:06.572659016 CEST	192.168.2.5	1.1.1.1	0x816d	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Aug 28, 2024 18:51:09.289952040 CEST	192.168.2.5	1.1.1.1	0xfe5b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.290306091 CEST	192.168.2.5	1.1.1.1	0xa156	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 18:51:09.290643930 CEST	192.168.2.5	1.1.1.1	0x9351	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.290812969 CEST	192.168.2.5	1.1.1.1	0x6791	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 18:51:09.291130066 CEST	192.168.2.5	1.1.1.1	0x5a9f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.291361094 CEST	192.168.2.5	1.1.1.1	0xf5cd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 18:51:09.291711092 CEST	192.168.2.5	1.1.1.1	0x3b89	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.291865110 CEST	192.168.2.5	1.1.1.1	0x7047	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 28, 2024 18:51:09.369601011 CEST	192.168.2.5	1.1.1.1	0xc0d5	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.369766951 CEST	192.168.2.5	1.1.1.1	0xbdff	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 28, 2024 18:51:06.579858065 CEST	1.1.1.1	192.168.2.5	0x816d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 18:51:06.580149889 CEST	1.1.1.1	192.168.2.5	0x7284	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 18:51:07.992168903 CEST	1.1.1.1	192.168.2.5	0xf0f3	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 18:51:07.992168903 CEST	1.1.1.1	192.168.2.5	0xf0f3	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.296762943 CEST	1.1.1.1	192.168.2.5	0xfe5b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.296762943 CEST	1.1.1.1	192.168.2.5	0xfe5b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.297334909 CEST	1.1.1.1	192.168.2.5	0xa156	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 18:51:09.297847986 CEST	1.1.1.1	192.168.2.5	0x6791	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 18:51:09.298299074 CEST	1.1.1.1	192.168.2.5	0x5a9f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.298299074 CEST	1.1.1.1	192.168.2.5	0x5a9f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.298659086 CEST	1.1.1.1	192.168.2.5	0x9351	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.298659086 CEST	1.1.1.1	192.168.2.5	0x9351	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.299045086 CEST	1.1.1.1	192.168.2.5	0x7047	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 18:51:09.299122095 CEST	1.1.1.1	192.168.2.5	0x3b89	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.299122095 CEST	1.1.1.1	192.168.2.5	0x3b89	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.299249887 CEST	1.1.1.1	192.168.2.5	0xf5cd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 28, 2024 18:51:09.380534887 CEST	1.1.1.1	192.168.2.5	0xc0d5	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.380534887 CEST	1.1.1.1	192.168.2.5	0xc0d5	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 28, 2024 18:51:09.380549908 CEST	1.1.1.1	192.168.2.5	0xbdff	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49721	13.107.246.60	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:08 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-28 16:51:08 UTC	559	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 16:51:08 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240828T165108Z-15c77d89844vht6zmafxh7wdkg0000000n4g00000000nr3t Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-28 16:51:08 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49723	13.107.246.60	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:08 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-28 16:51:08 UTC	583	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 16:51:08 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240828T165108Z-16579567576phhfj0h0z9mnmag00000000g0000000001q1s Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-28 16:51:08 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-08-28 16:51:08 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-08-28 16:51:08 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-08-28 16:51:09 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-08-28 16:51:09 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49724	162.159.61.3	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:09 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-28 16:51:09 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-28 16:51:09 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 28 Aug 2024 16:51:09 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ba5cdf29db442ea-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 16:51:09 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 02 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49727	172.64.41.3	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:09 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-28 16:51:09 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-28 16:51:09 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 28 Aug 2024 16:51:09 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ba5cdf28c7841b5-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 16:51:09 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 03 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49725	172.64.41.3	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:09 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-28 16:51:09 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-28 16:51:09 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 28 Aug 2024 16:51:09 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ba5cdf28e41436d-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 16:51:09 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49726	162.159.61.3	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:09 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-28 16:51:09 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-28 16:51:09 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 28 Aug 2024 16:51:09 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ba5cdf28e0e5e71-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 16:51:09 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e8 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49728	172.64.41.3	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:09 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-28 16:51:09 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-28 16:51:09 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 28 Aug 2024 16:51:09 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8ba5cdf31ebd43fd-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 16:51:09 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ff 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49734	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:10 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-28 16:51:10 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=233143 Date: Wed, 28 Aug 2024 16:51:10 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49735	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:11 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-28 16:51:11 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=233095 Date: Wed, 28 Aug 2024 16:51:11 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-28 16:51:11 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49738	142.250.80.46	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:12 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-28 16:51:12 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 28 Aug 2024 16:51:12 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49739	142.250.80.46	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:12 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-28 16:51:12 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 28 Aug 2024 16:51:12 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49740	142.251.40.228	443	7392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:12 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-28 16:51:13 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 28 Aug 2024 15:21:38 GMT Expires: Thu, 05 Sep 2024 15:21:38 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 5375 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-28 16:51:13 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-08-28 16:51:13 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-08-28 16:51:13 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-08-28 16:51:13 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-08-28 16:51:13 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49743	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=omkUsO6mR5ZdVXc&MD=alkXyk66 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-28 16:51:19 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b19ea95f-280b-401c-83c6-4c8bd3c44d46 MS-RequestId: 2a6c53bc-b8fd-42ff-bcff-bda6d573e2b2 MS-CV: C0nF+BJ7kUSvKkpd.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 28 Aug 2024 16:51:18 GMT Connection: close Content-Length: 24490
2024-08-28 16:51:19 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-28 16:51:19 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49750	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:51:59 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=omkUsO6mR5ZdVXc&MD=alkXyk66 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-28 16:51:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 695be027-d263-4164-9972-cd987902c308 MS-RequestId: 61d4975f-8f52-48b4-a6c0-7333399c3eec MS-CV: omrS3HevZ0OQHCvN.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 28 Aug 2024 16:51:58 GMT Connection: close Content-Length: 30005
2024-08-28 16:51:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-28 16:51:59 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	12:51:01
Start date:	28/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe50000
File size:	917'504 bytes
MD5 hash:	DC12B6F6672FB5207663BDC61E10F8AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	12:51:01
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:51:01
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2064,i,13060568358319835926,5078487426921904153,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:51:01
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:51:02
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2052,i,533442361611148287,17102799545326490740,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:51:06
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7160 --field-trial-handle=2052,i,533442361611148287,17102799545326490740,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:51:06
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7284 --field-trial-handle=2052,i,533442361611148287,17102799545326490740,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:51:19
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:51:20
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=2016,i,1888762196936444525,4492717181873450465,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:51:21
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=2640 --field-trial-handle=2016,i,1888762196936444525,4492717181873450465,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:51:27
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:51:28
Start date:	28/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3044 --field-trial-handle=2052,i,11996042725271471697,10916187422809690025,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5%
Total number of Nodes:	1360
Total number of Limit Nodes:	54

Executed Functions

Function 00E542DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00E5430D

Part of subcall function 00E56B57: _wcslen.LIBCMT ref: 00E56B6A

GetCurrentProcess.KERNEL32(?,00EECB64,00000000,?,?), ref: 00E54422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00E54429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00E54454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00E54466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00E54474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00E5447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00E544A0

Strings

|O, xrefs: 00E936F8
kernel32.dll, xrefs: 00E5444F
GetNativeSystemInfo, xrefs: 00E54460

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: a52477e19910e4da05885d63780c73f665f8b4f609a41394d1d58a51ee2454aa
Instruction ID: f98fd48b5f11c55ca2b824b51edf0ac8b9f62e83d2384ac1ea761d503b5c0066
Opcode Fuzzy Hash: a52477e19910e4da05885d63780c73f665f8b4f609a41394d1d58a51ee2454aa
Instruction Fuzzy Hash: 01A1C7A290B2CCCFCB31C7B97C441D57FE67B76309B146899D481A7662D2204E4BEB29

Function 00E542A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00E550AA,?,?,00000000,00000000), ref: 00E542B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00E550AA,?,?,00000000,00000000), ref: 00E542C9
LoadResource.KERNEL32(?,00000000,?,?,00E550AA,?,?,00000000,00000000,?,?,?,?,?,?,00E54F20), ref: 00E935BE
SizeofResource.KERNEL32(?,00000000,?,?,00E550AA,?,?,00000000,00000000,?,?,?,?,?,?,00E54F20), ref: 00E935D3
LockResource.KERNEL32(00E550AA,?,?,00E550AA,?,?,00000000,00000000,?,?,?,?,?,?,00E54F20,?), ref: 00E935E6

Strings

SCRIPT, xrefs: 00E542BF

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: b0fa62dc1585d2b02be6c90194f7c10c218399ded5cc5e7d3f60675976edd75d
Instruction ID: e8f5b811d389bccf147cb4e1b8ceb488f8d11f6b8edc0ead0e447b96f793441c
Opcode Fuzzy Hash: b0fa62dc1585d2b02be6c90194f7c10c218399ded5cc5e7d3f60675976edd75d
Instruction Fuzzy Hash: AD11C274200705BFD7219B66DC88F277BB9EBC9B56F204569F903EA1A0DB71DC468620

Function 00EBDBBE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,"R), ref: 00EBDBCE
GetFileAttributesW.KERNELBASE(?), ref: 00EBDBDD
FindFirstFileW.KERNEL32(?,?), ref: 00EBDBEE
FindClose.KERNEL32(00000000), ref: 00EBDBFA

Strings

"R, xrefs: 00EBDBCA

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID: "R
API String ID: 2695905019-1746183819
Opcode ID: 255f00925af83f8a3e69d20d687d920d113bbc3351d42065e7b6b15f5648d5f8
Instruction ID: 09cdc589c440359f8bde375824c13c61a9b1955ec85644bc92203f76a894ba38
Opcode Fuzzy Hash: 255f00925af83f8a3e69d20d687d920d113bbc3351d42065e7b6b15f5648d5f8
Instruction Fuzzy Hash: 4DF0EC3081491D5B82206B7C9C4E4EB7B6C9F05334B204702F935E20F0FBB05D59C9D5

Function 00E92BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00E52B6B

Part of subcall function 00E53A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00F21418,?,00E52E7F,?,?,?,00000000), ref: 00E53A78

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00F12224), ref: 00E92C10
ShellExecuteW.SHELL32(00000000,?,?,00F12224), ref: 00E92C17

Strings

runas, xrefs: 00E92C0B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 553a8c864f6fecd1c0844eaf8162e0d530255dfa5a3278cac004d05e5a5dc766
Instruction ID: 1596a5228e69507d8837d28faf735dceb041ff2213e7dafdd310d2df63042355
Opcode Fuzzy Hash: 553a8c864f6fecd1c0844eaf8162e0d530255dfa5a3278cac004d05e5a5dc766
Instruction Fuzzy Hash: F011A531208345AAC718FF70D8519AEB7E4AFA6746F443C2DFA56760A3DF20854E9712

Function 00EDAFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00EDB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00EDB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00EDB1D4
_wcslen.LIBCMT ref: 00EDB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00EDB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00EDB236
_wcslen.LIBCMT ref: 00EDB332

Part of subcall function 00EC05A7: GetStdHandle.KERNEL32(000000F6), ref: 00EC05C6

_wcslen.LIBCMT ref: 00EDB34B
_wcslen.LIBCMT ref: 00EDB366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00EDB3B6
GetLastError.KERNEL32(00000000), ref: 00EDB407
CloseHandle.KERNEL32(?), ref: 00EDB439
CloseHandle.KERNEL32(00000000), ref: 00EDB44A
CloseHandle.KERNEL32(00000000), ref: 00EDB45C
CloseHandle.KERNEL32(00000000), ref: 00EDB46E
CloseHandle.KERNEL32(?), ref: 00EDB4E3

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: e66a3759f00cc0cecd2578c5fffc91ae08e4cdfad5a22e9632736f3fd6668005
Instruction ID: 47df3472e7b0dd83eddbb6f33f93f25dd4c68a5220898c499d137669ba672004
Opcode Fuzzy Hash: e66a3759f00cc0cecd2578c5fffc91ae08e4cdfad5a22e9632736f3fd6668005
Instruction Fuzzy Hash: C7F17931504340DFC714EF24D891A6ABBE5EF85314F15985EF899AB3A2EB31EC06CB52

Function 00E5D73D Relevance: 21.6, APIs: 14, Instructions: 618windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00E5D807
timeGetTime.WINMM ref: 00E5DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E5DB28
TranslateMessage.USER32(?), ref: 00E5DB7B
DispatchMessageW.USER32(?), ref: 00E5DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E5DB9F
Sleep.KERNELBASE(0000000A), ref: 00E5DBB1

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: e44efe7d121917ecc22f3118a92f509df613c587398bff1084b18a506432549b
Instruction ID: dc9756c79f4c867c28b96b46cebe12fbde009584a32ee252772c6388db3e49af
Opcode Fuzzy Hash: e44efe7d121917ecc22f3118a92f509df613c587398bff1084b18a506432549b
Instruction Fuzzy Hash: 0142E330608245DFD738CF24CC84BAAB7E1BF8A319F14695DE955BB291D770E848CB92

Function 00E52CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00E52D07
RegisterClassExW.USER32(00000030), ref: 00E52D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E52D42
InitCommonControlsEx.COMCTL32(?), ref: 00E52D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E52D6F
LoadIconW.USER32(000000A9), ref: 00E52D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E52D94

Strings

TaskbarCreated, xrefs: 00E52D37
AutoIt v3 GUI, xrefs: 00E52D23
0, xrefs: 00E52CE9
+, xrefs: 00E52CF0

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 3b463ef417c5fd8db0dd077d9b136c4a537530a8aea26570859723aeda1dc5f2
Instruction ID: fec54c7dbba1389a80082ce8f41143d5949b75802affd8d0ba963083d4b90615
Opcode Fuzzy Hash: 3b463ef417c5fd8db0dd077d9b136c4a537530a8aea26570859723aeda1dc5f2
Instruction Fuzzy Hash: D321E3B190134CAFDB10DFA5E889BDDBBB4FB08700F10411AF911BA2A0D7B14586DF95

Function 00E9065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E9039A: CreateFileW.KERNELBASE(00000000,00000000,?,00E90704,?,?,00000000,?,00E90704,00000000,0000000C), ref: 00E903B7

GetLastError.KERNEL32 ref: 00E9076F
__dosmaperr.LIBCMT ref: 00E90776
GetFileType.KERNELBASE(00000000), ref: 00E90782
GetLastError.KERNEL32 ref: 00E9078C
__dosmaperr.LIBCMT ref: 00E90795
CloseHandle.KERNEL32(00000000), ref: 00E907B5
CloseHandle.KERNEL32(?), ref: 00E908FF
GetLastError.KERNEL32 ref: 00E90931
__dosmaperr.LIBCMT ref: 00E90938

Strings

H, xrefs: 00E908BD

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: eedaad7669305d722455b2e15c502621de8d1fbcfc5cec2a393850e0916c371b
Instruction ID: 059107f01779185fee36620fb95a4ca788b3583f82293790f6811dde663c9748
Opcode Fuzzy Hash: eedaad7669305d722455b2e15c502621de8d1fbcfc5cec2a393850e0916c371b
Instruction Fuzzy Hash: F5A12732A041488FDF29EF68D851BAD7BE0EB46324F145159F815BF2A2DB319C13DB91

Function 00E5344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E53A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00F21418,?,00E52E7F,?,?,?,00000000), ref: 00E53A78

Part of subcall function 00E53357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00E53379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00E5356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00E9318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00E931CE
RegCloseKey.ADVAPI32(?), ref: 00E93210
_wcslen.LIBCMT ref: 00E93277
_wcslen.LIBCMT ref: 00E93286

Strings

\, xrefs: 00E9328C
Software\AutoIt v3\AutoIt, xrefs: 00E53560
\Include\, xrefs: 00E53527
Include, xrefs: 00E93184, 00E931C5

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 2ed244e58672066e7f1a55fa0f62ff4cb0c7e6ed2839129aacffab009436102d
Instruction ID: 668ab21c2d9ec946517ec99cc5d0fde733440f71d023c5937c95f6a229fb3171
Opcode Fuzzy Hash: 2ed244e58672066e7f1a55fa0f62ff4cb0c7e6ed2839129aacffab009436102d
Instruction Fuzzy Hash: 4D71E671405305AEC724DF69EC8185BBBE8FF84340F50282EF945E71B1EB309A4ACB52

Function 00E52B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00E52B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00E52B9D
LoadIconW.USER32(00000063), ref: 00E52BB3
LoadIconW.USER32(000000A4), ref: 00E52BC5
LoadIconW.USER32(000000A2), ref: 00E52BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00E52BEF
RegisterClassExW.USER32(?), ref: 00E52C40

Part of subcall function 00E52CD4: GetSysColorBrush.USER32(0000000F), ref: 00E52D07
Part of subcall function 00E52CD4: RegisterClassExW.USER32(00000030), ref: 00E52D31
Part of subcall function 00E52CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E52D42
Part of subcall function 00E52CD4: InitCommonControlsEx.COMCTL32(?), ref: 00E52D5F
Part of subcall function 00E52CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E52D6F
Part of subcall function 00E52CD4: LoadIconW.USER32(000000A9), ref: 00E52D85
Part of subcall function 00E52CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E52D94

Strings

#, xrefs: 00E52C16
0, xrefs: 00E52C0F
AutoIt v3, xrefs: 00E52C2F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: fe15fb0c78ea567cbb9387ff27c5ab1fc745e8eded340b41861fd0360e1abd2b
Instruction ID: 780d0b53cde1235edf7d0293f18239dee868f0e687c6678ee87d5640e7120b6b
Opcode Fuzzy Hash: fe15fb0c78ea567cbb9387ff27c5ab1fc745e8eded340b41861fd0360e1abd2b
Instruction Fuzzy Hash: FF211070D0035CAFDB20DFA6EC95A9A7FB5FB58B50F10002AF500B6660D7B10956DF98

Function 00E53170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00E5316A,?,?), ref: 00E531D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00E5316A,?,?), ref: 00E53204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00E53227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00E5316A,?,?), ref: 00E53232
CreatePopupMenu.USER32 ref: 00E53246
PostQuitMessage.USER32(00000000), ref: 00E53267

Strings

TaskbarCreated, xrefs: 00E5322D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: c29973198c1b7334b9e7adeecf78ebac0d068531abcc52d5b8cc4b15db270d9c
Instruction ID: 04d55a229b0f0d93b731cccbe0c82d742c81abff1d999d78f196ef09d59bbf86
Opcode Fuzzy Hash: c29973198c1b7334b9e7adeecf78ebac0d068531abcc52d5b8cc4b15db270d9c
Instruction Fuzzy Hash: 3B419D34200608BBDF245B389D4DBB93B59F7153CAF14292AFD01B61A2CB718E49A765

Function 00E52C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00E52C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00E52CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00E51CAD,?), ref: 00E52CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00E51CAD,?), ref: 00E52CCF

Strings

edit, xrefs: 00E52CAC
AutoIt v3, xrefs: 00E52C89, 00E52C8E, 00E52C8F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: d194415cd1433c958cc48ac833a3eab06cd360c41eebae7e3e432ad9db904b08
Instruction ID: d57627972181202d4a963fdb588ce8445b2822eafe8fa321bbb3af5b5b562e02
Opcode Fuzzy Hash: d194415cd1433c958cc48ac833a3eab06cd360c41eebae7e3e432ad9db904b08
Instruction Fuzzy Hash: 44F030755403DC7AE73047236C48E773E7EE7DAF50B11002AF900A6160C2720C42EA74

Function 00EBE97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00EBE997
QueryPerformanceFrequency.KERNEL32(?), ref: 00EBE9A5
Sleep.KERNEL32(00000000), ref: 00EBE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00EBE9B7
Sleep.KERNELBASE ref: 00EBE9F3

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: d7507756bb5b303246022a930781bb2570e05bc0d6c42ffd9e53fd2d85a04b62
Instruction ID: efb8316b9445a12d84ec1d7c41a4a576e15b8ded4f693b3880683eabc1d6e460
Opcode Fuzzy Hash: d7507756bb5b303246022a930781bb2570e05bc0d6c42ffd9e53fd2d85a04b62
Instruction Fuzzy Hash: 9B019E31C0262DDBCF04AFE6DC99AEEBB78FF49301F101586E542B2240DB30A559CBA1

Function 00E53B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00E53B0F,SwapMouseButtons,00000004,?), ref: 00E53B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00E53B0F,SwapMouseButtons,00000004,?), ref: 00E53B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00E53B0F,SwapMouseButtons,00000004,?), ref: 00E53B83

Strings

Control Panel\Mouse, xrefs: 00E53B3E

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 588a935c811b521689ea0baa2ee4f87eeec79f80791e606f5d7f8aa57baa23c8
Instruction ID: 26165daf0d48bf575d74617a515fc897de34dd2d770f7cf23405b0ad27fb8c05
Opcode Fuzzy Hash: 588a935c811b521689ea0baa2ee4f87eeec79f80791e606f5d7f8aa57baa23c8
Instruction Fuzzy Hash: 93112AB5510218FFDB60CFA5DC84AEEB7B9EF04785B105859F805E7110D2319F499760

Function 00E53923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00E933A2

Part of subcall function 00E56B57: _wcslen.LIBCMT ref: 00E56B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00E53A04

Strings

Line: , xrefs: 00E933EB

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 27cedc0c13eacf6e71ce2a1d7ea9dd0b65a13230df8206d00a3857b0dadb3831
Instruction ID: 768c4f85a81cb133afc66042ba1adcae403f90e44d38c2d348938be3c14d34dd
Opcode Fuzzy Hash: 27cedc0c13eacf6e71ce2a1d7ea9dd0b65a13230df8206d00a3857b0dadb3831
Instruction Fuzzy Hash: 653124B1408308AAC721EB20DC45BEBB3D8AF94355F006D2AF999A3091DB709A4DC7C6

Function 00E6FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00E70668

Part of subcall function 00E732A4: RaiseException.KERNEL32(?,?,?,00E7068A,?,00F21444,?,?,?,?,?,?,00E7068A,00E51129,00F18738,00E51129), ref: 00E73304

__CxxThrowException@8.LIBVCRUNTIME ref: 00E70685

Strings

Unknown exception, xrefs: 00E70692

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: e67d22a2e2fdded5f13b959a218ca9f6168f4f132c9da8bc4470d2cbc6b4c344
Instruction ID: bee8d349ec2ac6e5783914170196ffd549f8214266ab245f533fe4a1a91da515
Opcode Fuzzy Hash: e67d22a2e2fdded5f13b959a218ca9f6168f4f132c9da8bc4470d2cbc6b4c344
Instruction Fuzzy Hash: E0F0C83490020DB7CB00F6B4E856D9E77AC5E40394B60E131F82CB55D2EF71EA65D581

Function 00E510F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E51BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00E51BF4
Part of subcall function 00E51BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00E51BFC
Part of subcall function 00E51BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00E51C07
Part of subcall function 00E51BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00E51C12
Part of subcall function 00E51BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00E51C1A
Part of subcall function 00E51BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00E51C22

Part of subcall function 00E51B4A: RegisterWindowMessageW.USER32(00000004,?,00E512C4), ref: 00E51BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00E5136A
OleInitialize.OLE32 ref: 00E51388
CloseHandle.KERNEL32(00000000,00000000), ref: 00E924AB

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: de12d0785099d6ef49ed10dcf850f93c00ea9268ab7824299ff8a66afa7b0cfa
Instruction ID: 19306ceb23dbda6f25b4895c17bc546c02588b7d31ba4b0db0ca09aecbe91fca
Opcode Fuzzy Hash: de12d0785099d6ef49ed10dcf850f93c00ea9268ab7824299ff8a66afa7b0cfa
Instruction Fuzzy Hash: 9C71C2B490124C8EC7A4EF79BD866953AE0FBE934431856BAD40AE7362E7344407EF4D

Function 00EBC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E53923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00E53A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00EBC259
KillTimer.USER32(?,00000001,?,?), ref: 00EBC261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00EBC270

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 51f28be2f86b6757c258546f391fefe31bcb01aa24a34a7d80103513b0b381bc
Instruction ID: f03f9700ceae80b24746b9cc256ee6c38509b3e5ac29d45d5646b89bc70be35f
Opcode Fuzzy Hash: 51f28be2f86b6757c258546f391fefe31bcb01aa24a34a7d80103513b0b381bc
Instruction Fuzzy Hash: 8631B670904744AFEB328F7488957E7BBEC9B06308F10149AE5D9B7251C3745A89CB51

Function 00E886AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00E885CC,?,00F18CC8,0000000C), ref: 00E88704
GetLastError.KERNEL32(?,00E885CC,?,00F18CC8,0000000C), ref: 00E8870E
__dosmaperr.LIBCMT ref: 00E88739

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 8b5364af464ec9a8c642611dbe7a350e6ab40e7bbf4fe73b27f6e9bc5cc439b3
Instruction ID: e77c75aa38057fccc01b014aca0c513e2afc3220cd3c840b9ff5c19ec03ca7f3
Opcode Fuzzy Hash: 8b5364af464ec9a8c642611dbe7a350e6ab40e7bbf4fe73b27f6e9bc5cc439b3
Instruction Fuzzy Hash: AE016B336046601AC23072346A4577E27994B8177CF782119FC1CFB0D3EEA19C82A350

Function 00E5DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00E5DB7B
DispatchMessageW.USER32(?), ref: 00E5DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E5DB9F
Sleep.KERNELBASE(0000000A), ref: 00E5DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00EA1CC9

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: e0019bcbecca40945c18838533ab54d50788f695dcfd0db9b2448640187d3ba4
Instruction ID: c541df4d31d727dadd6c675b4296cbb419802704f5c0cef307ad321b2e7f4813
Opcode Fuzzy Hash: e0019bcbecca40945c18838533ab54d50788f695dcfd0db9b2448640187d3ba4
Instruction Fuzzy Hash: 2CF05E306483849BE734CBB19C89FEA73A9FB49315F105929FA0AE70C0DB30A48D9B15

Function 00E61310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00E617F6

Strings

CALL, xrefs: 00E617C6

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 443efd47f202f6f78d73191c367dbe440749cd50b8cc92de668db641c407a8b7
Instruction ID: 971d98721fa6b5a76fa1cbcb6d93ec01346ac36d1e2bae13e44a02dede1738c3
Opcode Fuzzy Hash: 443efd47f202f6f78d73191c367dbe440749cd50b8cc92de668db641c407a8b7
Instruction Fuzzy Hash: 5622BD706083019FC715DF14D480B6ABBF1BF8A394F18999DF496AB362D731E845CB82

Function 00E52DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00E92C8C

Part of subcall function 00E53AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E53A97,?,?,00E52E7F,?,?,?,00000000), ref: 00E53AC2

Part of subcall function 00E52DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00E52DC4

Strings

X, xrefs: 00E92C5A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 7da5fd1a44f07b4cc56dfe545f09a869f9d1611350c0543fc759a668d04f4013
Instruction ID: 2103583a8b4745694638148f15273e0bfd9532dc65e8052a41531d1b7021adfc
Opcode Fuzzy Hash: 7da5fd1a44f07b4cc56dfe545f09a869f9d1611350c0543fc759a668d04f4013
Instruction Fuzzy Hash: 1F21C371A00298AFDF01EF94C845BEE7BF9AF49305F009459E905FB241EBB45A8DCB61

Function 00E53837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00E53908

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 9b6c878b2ec6b783098ab3f0415614c39c5271eec8f0b39a8e94b7e58db65c98
Instruction ID: d7aae5fd16b99842f65b123840f32e8d93ad2026df6ed957fdbf21bffce90454
Opcode Fuzzy Hash: 9b6c878b2ec6b783098ab3f0415614c39c5271eec8f0b39a8e94b7e58db65c98
Instruction Fuzzy Hash: 2F31C1B05043059FD721DF34D88579BBBE8FB49349F000D2EF999A7280E771AA48CB52

Function 00E6F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00E6F661

Part of subcall function 00E5D73D: GetInputState.USER32 ref: 00E5D807

Sleep.KERNEL32(00000000), ref: 00EAF2DE

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: d17738d522423223c333dea43ff399227a07d3f63858c20fe3ff3321a0b980a3
Instruction ID: 65865cfc8dd771eeca7bb45e9071e166ab2615c95a72c6bc4d1a1131737192be
Opcode Fuzzy Hash: d17738d522423223c333dea43ff399227a07d3f63858c20fe3ff3321a0b980a3
Instruction Fuzzy Hash: 44F082312402059FD314EF75D445B5AB7E9EF49761F00142AF859EB260DB70A844CB91

Function 00E5B710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00E5BB4E

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 8e8e140bf62336d837eaafab2a8e3726f4673b3d040288c7e29bb8a5a5b3f943
Instruction ID: 834f665fba5144b87bdabcd38f81036ff16ef3adbd7b4f1550230a30a2389b71
Opcode Fuzzy Hash: 8e8e140bf62336d837eaafab2a8e3726f4673b3d040288c7e29bb8a5a5b3f943
Instruction Fuzzy Hash: E032CF30A00209EFCF24CF54C894ABEB7B9EF49319F14A459ED05BB262C775AD49CB91

Function 00EE2598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00EE2649

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: f80e000db2642b1814c48690619ff5d79ed5cf48dd20ff7dd536f6e3d93f300a
Instruction ID: edc7be1fdb2402dea95103fe76ee67094a57e7dab30717dfec538288fb69188b
Opcode Fuzzy Hash: f80e000db2642b1814c48690619ff5d79ed5cf48dd20ff7dd536f6e3d93f300a
Instruction Fuzzy Hash: F621037020024AAFD710DF26C8D0976B79DFB4436CB24956CE996AB392C771ED45CB90

Function 00EE13B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00EE1420

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: efdbeec98a9bc2d4442363277dbe6ac60b02a810ffbe3681576496bdea4a1219
Instruction ID: 6a9ddacd33f422eab7162b7856ff23819e96edfca4111c2edbfe309d5ccd8627
Opcode Fuzzy Hash: efdbeec98a9bc2d4442363277dbe6ac60b02a810ffbe3681576496bdea4a1219
Instruction Fuzzy Hash: CB31A230204246AFD714EF26C491B69B7E1FF84328F1495A8E8256B392DB31EC85CBD0

Function 00E54ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E54E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00E54EDD,?,00F21418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E54E9C
Part of subcall function 00E54E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00E54EAE
Part of subcall function 00E54E90: FreeLibrary.KERNEL32(00000000,?,?,00E54EDD,?,00F21418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E54EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00F21418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E54EFD

Part of subcall function 00E54E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00E93CDE,?,00F21418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E54E62
Part of subcall function 00E54E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00E54E74
Part of subcall function 00E54E59: FreeLibrary.KERNEL32(00000000,?,?,00E93CDE,?,00F21418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E54E87

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: f1287a2d77ac9f09403936641f885e467767812292ee2f7b1ab37fa7651fb6a7
Instruction ID: 486ed58da616c1beda4c6ddcf483487c31a9c2da94ef86475a41f565a2b92919
Opcode Fuzzy Hash: f1287a2d77ac9f09403936641f885e467767812292ee2f7b1ab37fa7651fb6a7
Instruction Fuzzy Hash: BF110472700605ABCF14AB64DC02FAD77E49F44716F20A82DF942BA1C1DE709A899B60

Function 00E88402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00E88440

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 087fe90e6435ac4dc49eb22e0beb2e613e5b051626078aabc9b4b20272a3d299
Instruction ID: ee12b7d0be15b73d533026f7c3d7eef0308052156def9188a6ca3d6ff3624bd1
Opcode Fuzzy Hash: 087fe90e6435ac4dc49eb22e0beb2e613e5b051626078aabc9b4b20272a3d299
Instruction Fuzzy Hash: EB11067690410AAFCB15DF58EA4199E7BF5EF48314F104059FC18AB312DB31DA118BA5

Function 00EE29BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,00EE14B5,?), ref: 00EE2A01

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 2c01adf3364d49a3eb084112ed39353f540bd6dbd560f0d5b1cc4ee7e84f650d
Instruction ID: 8883fcbe7defd1d9d62fa837719301c93616fa9b920bd398422ce4743cd9458f
Opcode Fuzzy Hash: 2c01adf3364d49a3eb084112ed39353f540bd6dbd560f0d5b1cc4ee7e84f650d
Instruction Fuzzy Hash: 000192363006C59FD3248E2EC454B26379AEBC5318F29E46DD24BAB251D732EC42C790

Function 00E7E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 395aee596b7935a71f623e992244e97da9379646527cd5affa4f204a9d649357
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 6AF02832510A14AAD7313AA99C05B9A33DC9F96334F10A799F92DB33D2DB74D80187A5

Function 00EE149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 00EE14EB

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: cffb170a00db2317a1b5ebb06116648a43c4089e8bcb83d6ea2c02bbcab9b192
Instruction ID: 5597750cc6fb43d3f3d258ac3d5f857f948e9e2a8c635ce1634d5a53ea201e4e
Opcode Fuzzy Hash: cffb170a00db2317a1b5ebb06116648a43c4089e8bcb83d6ea2c02bbcab9b192
Instruction Fuzzy Hash: 7C01D4353087899FD320CFABC440826BB95FF8432875490AEE85A9F742D732DD82C780

Function 00E83820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00F21444,?,00E6FDF5,?,?,00E5A976,00000010,00F21440,00E513FC,?,00E513C6,?,00E51129), ref: 00E83852

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 67fe41f7b45d95a9b9de301226de3d5ad1baea4dc3706da78c96ee2c93bdf928
Instruction ID: be095651361196cb93bb84542570b33bce7d0d4da2b9f728b6925ca0472f1144
Opcode Fuzzy Hash: 67fe41f7b45d95a9b9de301226de3d5ad1baea4dc3706da78c96ee2c93bdf928
Instruction Fuzzy Hash: ECE0E5312012245BD63937B79C05B9A36C9AB42FB4F152220FC1CB64D1DB20DD0183E0

Function 00E54F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00F21418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E54F6D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 8b136701426d8950992239220a997d7a2047c37da0d4dcf7d14ec13afd899a9f
Instruction ID: a28db9cb4dd718b5e9da1ed6b98cb77d3547895fe868b9aa98aac8e4794fdf25
Opcode Fuzzy Hash: 8b136701426d8950992239220a997d7a2047c37da0d4dcf7d14ec13afd899a9f
Instruction Fuzzy Hash: 24F030B1205751CFDB349F68D490852B7F4BF1431E320AD7EE5DAA6651C7319888DF20

Function 00EE2A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00EE2A66

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 3d8b8c97286a24e356cd41a7f343f26851c7ffed7f24a19c9e82ae9726ca129f
Instruction ID: 321512d37eca786b048675d195921d3a20aaf914d9c0c0f82dbde751b1e853f5
Opcode Fuzzy Hash: 3d8b8c97286a24e356cd41a7f343f26851c7ffed7f24a19c9e82ae9726ca129f
Instruction Fuzzy Hash: 5AE0DF7234015AAEC710EE31EC808FA738CEB50398B10143ABD1AE2100DB308A8682E0

Function 00E52DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00E52DC4

Part of subcall function 00E56B57: _wcslen.LIBCMT ref: 00E56B6A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 8014fa244baf89ea3d5f58425d6100565ecad4cfad1613962139cf9fde7b5d19
Instruction ID: 1cecb6ba0d4e6235ab38c533caca47be5c713bf7f90d51822265d56629a8cd50
Opcode Fuzzy Hash: 8014fa244baf89ea3d5f58425d6100565ecad4cfad1613962139cf9fde7b5d19
Instruction Fuzzy Hash: 3BE0CD726001285BCB1092589C06FEA77DDDFC8790F0400B1FD09F7258D970AD848550

Function 00E52B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00E53837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00E53908

Part of subcall function 00E5D73D: GetInputState.USER32 ref: 00E5D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00E52B6B

Part of subcall function 00E530F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00E5314E

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 41d8ca2a7f8d7d3a3b4dbcf325af8961db199d48f4d83f95dbc026c49c0d36a2
Instruction ID: 86823734f476aaf5d9ebff185215e2626022220124f6248a5c2f89145547025b
Opcode Fuzzy Hash: 41d8ca2a7f8d7d3a3b4dbcf325af8961db199d48f4d83f95dbc026c49c0d36a2
Instruction Fuzzy Hash: DBE0262230424806C60CBB30A8524ADB7D99BE6393F403C3EF946A31A3CE24454E8311

Function 00EB3D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00EB3D18

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: e3f76bb9ada95775c1a7b3d35af2397a983c0036aa684954680dd1999af02b04
Instruction ID: 7ff04714a4bf0c04c1917959677d3b379257a09aa381e4416caf27c461c5a5db
Opcode Fuzzy Hash: e3f76bb9ada95775c1a7b3d35af2397a983c0036aa684954680dd1999af02b04
Instruction Fuzzy Hash: 19D012E06A03087EFB0083728C0BEBB329CC316E81F104BA47A02EA4C1D9A0DE090130

Function 00E9039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00E90704,?,?,00000000,?,00E90704,00000000,0000000C), ref: 00E903B7

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1c6258a440c231ff3213f4d6c757db9cd96b84d1e3086d6ab05bd607bde805f3
Instruction ID: b663870b6d2b3c0af29375b0ed74a05a5f0e4eda899a9fdc62f1660a7d9e9312
Opcode Fuzzy Hash: 1c6258a440c231ff3213f4d6c757db9cd96b84d1e3086d6ab05bd607bde805f3
Instruction Fuzzy Hash: 4CD06C3204014DBFDF028F85DD46EDA3FAAFB48714F114000BE5866020C732E822AB91

Function 00E51CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00E51CBC

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 9afe9ee8ed06d779266ddab96cb286ffac3fa51162942dae5a7c361ca5b1f7db
Instruction ID: 6bad27eef77e2975464a02cb204a3bbdbd833672de8f24bd214c79bae5ec1191
Opcode Fuzzy Hash: 9afe9ee8ed06d779266ddab96cb286ffac3fa51162942dae5a7c361ca5b1f7db
Instruction Fuzzy Hash: 06C0923628034CBFF2248B80BC8BF107765B35CB00F188001F609A95E3C3A22826FA94

Non-executed Functions

Function 00EE9576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00E69BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E69BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00EE961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00EE965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00EE969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00EE96C9
SendMessageW.USER32 ref: 00EE96F2
GetKeyState.USER32(00000011), ref: 00EE978B
GetKeyState.USER32(00000009), ref: 00EE9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00EE97AE
GetKeyState.USER32(00000010), ref: 00EE97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00EE97E9
SendMessageW.USER32 ref: 00EE9810
SendMessageW.USER32(?,00001030,?,00EE7E95), ref: 00EE9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00EE992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00EE9941
SetCapture.USER32(?), ref: 00EE994A
ClientToScreen.USER32(?,?), ref: 00EE99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00EE99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00EE99D6
ReleaseCapture.USER32 ref: 00EE99E1
GetCursorPos.USER32(?), ref: 00EE9A19
ScreenToClient.USER32(?,?), ref: 00EE9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00EE9A80
SendMessageW.USER32 ref: 00EE9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00EE9AEB
SendMessageW.USER32 ref: 00EE9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00EE9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00EE9B4A
GetCursorPos.USER32(?), ref: 00EE9B68
ScreenToClient.USER32(?,?), ref: 00EE9B75
GetParent.USER32(?), ref: 00EE9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00EE9BFA
SendMessageW.USER32 ref: 00EE9C2B
ClientToScreen.USER32(?,?), ref: 00EE9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00EE9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00EE9CDE
SendMessageW.USER32 ref: 00EE9D01
ClientToScreen.USER32(?,?), ref: 00EE9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00EE9D82

Part of subcall function 00E69944: GetWindowLongW.USER32(?,000000EB), ref: 00E69952

GetWindowLongW.USER32(?,000000F0), ref: 00EE9E05

Strings

F, xrefs: 00EE9D07
@GUI_DRAGID, xrefs: 00EE997D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 29f1da06618ce9d495420e117819230977298e73d239365fd8c8a090ff2254de
Instruction ID: 69ea197e8123a4c33c8c3815ef42884aac21218112b6daa38b3f796228280166
Opcode Fuzzy Hash: 29f1da06618ce9d495420e117819230977298e73d239365fd8c8a090ff2254de
Instruction Fuzzy Hash: F742B030204289AFD720CF26CC84EAABBF5FF49714F14161AF999A72A2D731DC55CB42

Function 00EE4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00EE48F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00EE4908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00EE4927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00EE494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00EE495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00EE497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00EE49AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00EE49D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00EE4A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00EE4A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00EE4A7E
IsMenu.USER32(?), ref: 00EE4A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00EE4AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00EE4B20
GetWindowLongW.USER32(?,000000F0), ref: 00EE4B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00EE4BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00EE4C82
wsprintfW.USER32 ref: 00EE4CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00EE4CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00EE4CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00EE4D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00EE4D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00EE4D5A

Strings

%d/%02d/%02d, xrefs: 00EE4CA8

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: f02744e2bc65fa2ff61bbe43d2dafff95b3dbd61ce1c891549328a390353dd08
Instruction ID: d9e1af6bc4d2c2ec86db249f966fe821a18e9d215ffea81d1e6ed46695ee05f0
Opcode Fuzzy Hash: f02744e2bc65fa2ff61bbe43d2dafff95b3dbd61ce1c891549328a390353dd08
Instruction Fuzzy Hash: 0B12F0B1A00289AFEB248F26DC49FAE7BF8AF44714F106129F915FB2E1D7749941CB50

Function 00E6F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00E6F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00EAF474
IsIconic.USER32(00000000), ref: 00EAF47D
ShowWindow.USER32(00000000,00000009), ref: 00EAF48A
SetForegroundWindow.USER32(00000000), ref: 00EAF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00EAF4AA
GetCurrentThreadId.KERNEL32 ref: 00EAF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00EAF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00EAF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00EAF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00EAF4DE
SetForegroundWindow.USER32(00000000), ref: 00EAF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EAF4F6
keybd_event.USER32(00000012,00000000), ref: 00EAF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EAF50B
keybd_event.USER32(00000012,00000000), ref: 00EAF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EAF519
keybd_event.USER32(00000012,00000000), ref: 00EAF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EAF528
keybd_event.USER32(00000012,00000000), ref: 00EAF52D
SetForegroundWindow.USER32(00000000), ref: 00EAF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00EAF557

Strings

Shell_TrayWnd, xrefs: 00EAF46F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: e670abde21c58aa3bc82054d86849fb8fb22c32133de0bfb8a8d1861699fbf1d
Instruction ID: 167c8d224dc4a2356de28656a84e46c8c32a19c25edd05b42d4b52366aaa88ec
Opcode Fuzzy Hash: e670abde21c58aa3bc82054d86849fb8fb22c32133de0bfb8a8d1861699fbf1d
Instruction Fuzzy Hash: 67315371A4025C7FEB206BF65C89FBF7E6DEB49B50F200065FA01FA1D1C6B06D01AA61

Function 00EB1201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00EB16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EB170D
Part of subcall function 00EB16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00EB173A
Part of subcall function 00EB16C3: GetLastError.KERNEL32 ref: 00EB174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00EB1286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00EB12A8
CloseHandle.KERNEL32(?), ref: 00EB12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00EB12D1
GetProcessWindowStation.USER32 ref: 00EB12EA
SetProcessWindowStation.USER32(00000000), ref: 00EB12F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00EB1310

Part of subcall function 00EB10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00EB11FC), ref: 00EB10D4
Part of subcall function 00EB10BF: CloseHandle.KERNEL32(?,?,00EB11FC), ref: 00EB10E9

Strings

, xrefs: 00EB125A
default, xrefs: 00EB130B
winsta0, xrefs: 00EB12CC

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 854d0e1b6a056b8ee2a04e42f3aa7e7619673f1f467b0948708a44b9ea987bb4
Instruction ID: ba5b17082c94fe059c52744cc3275db49b49f269e5781a3fbec87801e2f9b7bd
Opcode Fuzzy Hash: 854d0e1b6a056b8ee2a04e42f3aa7e7619673f1f467b0948708a44b9ea987bb4
Instruction Fuzzy Hash: EE81AC71900249AFDF219FA4DC99FEF7BB9EF04718F1451A9FA20B61A0DB318945CB21

Function 00EB0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00EB1114
Part of subcall function 00EB10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00EB0B9B,?,?,?), ref: 00EB1120
Part of subcall function 00EB10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00EB0B9B,?,?,?), ref: 00EB112F
Part of subcall function 00EB10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00EB0B9B,?,?,?), ref: 00EB1136
Part of subcall function 00EB10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00EB114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00EB0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00EB0C00
GetLengthSid.ADVAPI32(?), ref: 00EB0C17
GetAce.ADVAPI32(?,00000000,?), ref: 00EB0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00EB0C6D
GetLengthSid.ADVAPI32(?), ref: 00EB0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00EB0C8C
HeapAlloc.KERNEL32(00000000), ref: 00EB0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00EB0CB4
CopySid.ADVAPI32(00000000), ref: 00EB0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00EB0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00EB0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00EB0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EB0D45
HeapFree.KERNEL32(00000000), ref: 00EB0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EB0D55
HeapFree.KERNEL32(00000000), ref: 00EB0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EB0D65
HeapFree.KERNEL32(00000000), ref: 00EB0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00EB0D78
HeapFree.KERNEL32(00000000), ref: 00EB0D7F

Part of subcall function 00EB1193: GetProcessHeap.KERNEL32(00000008,00EB0BB1,?,00000000,?,00EB0BB1,?), ref: 00EB11A1
Part of subcall function 00EB1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00EB0BB1,?), ref: 00EB11A8
Part of subcall function 00EB1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00EB0BB1,?), ref: 00EB11B7

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 02c8adfb55de6448ab46b234dc03db86d27005c3cef28cae005a861f6a4e4b57
Instruction ID: 19c1cebea6108a98b08bead73fc2160d384c6986d0bd705060cd57ca2eccc994
Opcode Fuzzy Hash: 02c8adfb55de6448ab46b234dc03db86d27005c3cef28cae005a861f6a4e4b57
Instruction Fuzzy Hash: BB718A7290020AAFDF10DFA5DC84BEFBBB8BF04314F145515F915BA1A1D771AA46CBA0

Function 00ECEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00EECC08), ref: 00ECEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00ECEB37
GetClipboardData.USER32(0000000D), ref: 00ECEB43
CloseClipboard.USER32 ref: 00ECEB4F
GlobalLock.KERNEL32(00000000), ref: 00ECEB87
CloseClipboard.USER32 ref: 00ECEB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00ECEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00ECEBC9
GetClipboardData.USER32(00000001), ref: 00ECEBD1
GlobalLock.KERNEL32(00000000), ref: 00ECEBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 00ECEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00ECEC38
GetClipboardData.USER32(0000000F), ref: 00ECEC44
GlobalLock.KERNEL32(00000000), ref: 00ECEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00ECEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00ECEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00ECECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 00ECECF3
CountClipboardFormats.USER32 ref: 00ECED14
CloseClipboard.USER32 ref: 00ECED59

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 2ec3c71c3cc6778ebd2cfe4e802ff7ce9eebe3e613f2a6099025f7cbbe41dc5c
Instruction ID: 8ffe9dfa7f7b247c9fe2045dd1ee92ea97cc141f1aa98622f15a30ee0b2616c7
Opcode Fuzzy Hash: 2ec3c71c3cc6778ebd2cfe4e802ff7ce9eebe3e613f2a6099025f7cbbe41dc5c
Instruction Fuzzy Hash: 2B61D2342043469FD310EF60D985F7A7BE4AF84708F14651DF856AB2A2CB32DD0ACB62

Function 00EC698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00EC69BE
FindClose.KERNEL32(00000000), ref: 00EC6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00EC6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00EC6A75

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00EC6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00EC6ADF

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00EC6B6A
%02d, xrefs: 00EC6C00, 00EC6C0A, 00EC6C5A, 00EC6CAA, 00EC6CFA, 00EC6D4A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00EC6B32
%03d, xrefs: 00EC6DA2
%4d, xrefs: 00EC6BB1

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 42fcdeeadeff223373844b0d45068809a1be040833e179d2fff6acec3b9f98f6
Instruction ID: dba817d0b3c6e96ec4e2d2d1638de6ae0d27f34a46c11dd45e169e1293e21e18
Opcode Fuzzy Hash: 42fcdeeadeff223373844b0d45068809a1be040833e179d2fff6acec3b9f98f6
Instruction Fuzzy Hash: 10D19171508300AFC304EBA0D991EAFB7ECAF88705F44591DF985E7192EB35DA09CB62

Function 00EC9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00EC9663
GetFileAttributesW.KERNEL32(?), ref: 00EC96A1
SetFileAttributesW.KERNEL32(?,?), ref: 00EC96BB
FindNextFileW.KERNEL32(00000000,?), ref: 00EC96D3
FindClose.KERNEL32(00000000), ref: 00EC96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00EC96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00EC974A
SetCurrentDirectoryW.KERNEL32(00F16B7C), ref: 00EC9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00EC9772
FindClose.KERNEL32(00000000), ref: 00EC977F
FindClose.KERNEL32(00000000), ref: 00EC978F

Strings

*.*, xrefs: 00EC96F5

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 5adcfb991e1f8022432beda99c2a4aa03140fda86c44d3fd028558e86c290be4
Instruction ID: 8b3e1e1ee101730820a64d6a934aea3451334bc140ac6a7a874b24bb4d8ac617
Opcode Fuzzy Hash: 5adcfb991e1f8022432beda99c2a4aa03140fda86c44d3fd028558e86c290be4
Instruction Fuzzy Hash: 79311F3250164D6ECB10EFB5DD4DEDE33ACAF08324F20405AF914F20A2DB72CE868A10

Function 00EC979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00EC97BE
FindNextFileW.KERNEL32(00000000,?), ref: 00EC9819
FindClose.KERNEL32(00000000), ref: 00EC9824
FindFirstFileW.KERNEL32(*.*,?), ref: 00EC9840
SetCurrentDirectoryW.KERNEL32(?), ref: 00EC9890
SetCurrentDirectoryW.KERNEL32(00F16B7C), ref: 00EC98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00EC98B8
FindClose.KERNEL32(00000000), ref: 00EC98C5
FindClose.KERNEL32(00000000), ref: 00EC98D5

Part of subcall function 00EBDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00EBDB00

Strings

*.*, xrefs: 00EC983B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: d3eecde42ca8f8c04ad2bf0c765d8aee5bfd852c649297ea8f3a31c2c72630de
Instruction ID: 634300840594322a3e85fd49be3c915b1878985da8a452dab6705c12659f4c24
Opcode Fuzzy Hash: d3eecde42ca8f8c04ad2bf0c765d8aee5bfd852c649297ea8f3a31c2c72630de
Instruction Fuzzy Hash: F131E2325006596EDB14EFA5DC48EDE77AC9F0A324F205059F814B30A2DB72DA868A20

Function 00EDBE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00EDB6AE,?,?), ref: 00EDC9B5
Part of subcall function 00EDC998: _wcslen.LIBCMT ref: 00EDC9F1
Part of subcall function 00EDC998: _wcslen.LIBCMT ref: 00EDCA68
Part of subcall function 00EDC998: _wcslen.LIBCMT ref: 00EDCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00EDBF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00EDBFA9
RegCloseKey.ADVAPI32(00000000), ref: 00EDBFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00EDC02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00EDC0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00EDC154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00EDC1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00EDC23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00EDC2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00EDC382
RegCloseKey.ADVAPI32(00000000), ref: 00EDC38F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: cf4292f2d3a9671f0ccd782133f6203a22bdb0dfc17ceb0a5a61c8181be7b167
Instruction ID: 17774008912bb2cd4760b580975177665f4e683fed6832f3c3d368c5e497f9e4
Opcode Fuzzy Hash: cf4292f2d3a9671f0ccd782133f6203a22bdb0dfc17ceb0a5a61c8181be7b167
Instruction Fuzzy Hash: B3025E716042019FC714CF24C895E2ABBE5EF89358F18989DF849EB3A2D731ED46CB51

Function 00EC8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00EC8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00EC8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00EC8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00EC8310
SetCurrentDirectoryW.KERNEL32(?), ref: 00EC8324
SetCurrentDirectoryW.KERNEL32(?), ref: 00EC8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00EC838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00EC8395

Strings

*.*, xrefs: 00EC839B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 5f1929896d8bdc95680880f4c586dca77b5313fba58e2e81588af4eea66c1e97
Instruction ID: f1b7052c14fd6126930bba7ec2e144e0165a61fca72d6eb7fb39ddc5bac0f117
Opcode Fuzzy Hash: 5f1929896d8bdc95680880f4c586dca77b5313fba58e2e81588af4eea66c1e97
Instruction Fuzzy Hash: 62618C715043459FC710EF64CA44E9EB3E8FF89314F14981EF989A7251EB31E94ACB92

Function 00EBD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E53AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E53A97,?,?,00E52E7F,?,?,?,00000000), ref: 00E53AC2

Part of subcall function 00EBE199: GetFileAttributesW.KERNEL32(?,00EBCF95), ref: 00EBE19A

FindFirstFileW.KERNEL32(?,?), ref: 00EBD122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00EBD1DD
MoveFileW.KERNEL32(?,?), ref: 00EBD1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00EBD20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00EBD237

Part of subcall function 00EBD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00EBD21C,?,?), ref: 00EBD2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00EBD253
FindClose.KERNEL32(00000000), ref: 00EBD264

Strings

\*.*, xrefs: 00EBD0CD, 00EBD0D6, 00EBD0EB

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 98d6dc3200dcc953a1f676ed08fbe2fde60ee92ee93d759d43d7f3e90ddbe592
Instruction ID: c7ebf67f99f05cd05d8bc0ff550ce7793f68b697ff44ef468fbb3041656b11b5
Opcode Fuzzy Hash: 98d6dc3200dcc953a1f676ed08fbe2fde60ee92ee93d759d43d7f3e90ddbe592
Instruction Fuzzy Hash: 6E61793180514DAECF05EBE0DE929EEB7B5AF54305F245565E802B71A2EB34AF0DCB60

Function 00ECED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00ECED91
EmptyClipboard.USER32 ref: 00ECED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00ECEDAC
CloseClipboard.USER32 ref: 00ECEEA3

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 76642edf3c08659fb5a8cee32346ce1888032dec6f13cabc7b095bde3529ddbf
Instruction ID: 0cab747067e4a6387d9e87f9c10d75be8e27f2a777e286544edbe4f21c87b25c
Opcode Fuzzy Hash: 76642edf3c08659fb5a8cee32346ce1888032dec6f13cabc7b095bde3529ddbf
Instruction Fuzzy Hash: 56419B31204651AFD720DF25D888F1ABBE1EF44358F24949DE816AF762C736EC46CB90

Function 00EBE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EB170D
Part of subcall function 00EB16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00EB173A
Part of subcall function 00EB16C3: GetLastError.KERNEL32 ref: 00EB174A

ExitWindowsEx.USER32(?,00000000), ref: 00EBE932

Strings

SeShutdownPrivilege, xrefs: 00EBE902
, xrefs: 00EBE920
@, xrefs: 00EBE925
, xrefs: 00EBE95C

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: e638e7eaa7677ca8d1d5b3aa9a275436581b7f353c2847b2ed0d7ccc8f57b756
Instruction ID: f5b5ba814d367954fa32525e25b3598c296bd9484dcc99b50f7de6df257f7eb2
Opcode Fuzzy Hash: e638e7eaa7677ca8d1d5b3aa9a275436581b7f353c2847b2ed0d7ccc8f57b756
Instruction Fuzzy Hash: E1014933610314AFEB1827F59C86FFF729C9744754F242462FC13F22D1D5A05C488190

Function 00ED1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00ED1276
WSAGetLastError.WSOCK32 ref: 00ED1283
bind.WSOCK32(00000000,?,00000010), ref: 00ED12BA
WSAGetLastError.WSOCK32 ref: 00ED12C5
closesocket.WSOCK32(00000000), ref: 00ED12F4
listen.WSOCK32(00000000,00000005), ref: 00ED1303
WSAGetLastError.WSOCK32 ref: 00ED130D
closesocket.WSOCK32(00000000), ref: 00ED133C

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 79af7895912d0092bbe9a59bcf4ebbf64ba8e10aab3e36bedf52db6fdcfb8db5
Instruction ID: 76260c0ad9c35b40554f36cbe452a78d7142b76c595c58320c42458ae0c1a01e
Opcode Fuzzy Hash: 79af7895912d0092bbe9a59bcf4ebbf64ba8e10aab3e36bedf52db6fdcfb8db5
Instruction Fuzzy Hash: FD418231600240AFD714DF64C5C4B29BBE5EF46318F289189E856AF3A2C771ED86CBE1

Function 00E8B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E8B9D4
_free.LIBCMT ref: 00E8B9F8
_free.LIBCMT ref: 00E8BB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00EF3700), ref: 00E8BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00F2121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00E8BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00F21270,000000FF,?,0000003F,00000000,?), ref: 00E8BC36
_free.LIBCMT ref: 00E8BD4B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 5685d2a7488798d0ba8edbaa59bace35fa39f91312d70d9a2b20ab5ec625d536
Instruction ID: 983c862a6420ac2272fe5b01d025872371324ab3a8d6f94829e071e1c8045e06
Opcode Fuzzy Hash: 5685d2a7488798d0ba8edbaa59bace35fa39f91312d70d9a2b20ab5ec625d536
Instruction Fuzzy Hash: 13C12771904209AFDB24BF688C41BAEBBF8EF51314F1461AAE49CFB291E7309E41D750

Function 00EBD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E53AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E53A97,?,?,00E52E7F,?,?,?,00000000), ref: 00E53AC2

Part of subcall function 00EBE199: GetFileAttributesW.KERNEL32(?,00EBCF95), ref: 00EBE19A

FindFirstFileW.KERNEL32(?,?), ref: 00EBD420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00EBD470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00EBD481
FindClose.KERNEL32(00000000), ref: 00EBD498
FindClose.KERNEL32(00000000), ref: 00EBD4A1

Strings

\*.*, xrefs: 00EBD3F2

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: d9e42c69975c97d0930855ff43635853cfbf55e15a81b7011c02e438f8d2409a
Instruction ID: b4d9928198f8955b18104d788dc5253621606566fdebdf3238818619d27d3f09
Opcode Fuzzy Hash: d9e42c69975c97d0930855ff43635853cfbf55e15a81b7011c02e438f8d2409a
Instruction Fuzzy Hash: 8D314F7100C3859FC204EF64D8918EF77E8AE95315F446E2DF9E5A31A1EB20AA0D8763

Function 00E8E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00E8E645

Strings

1#QNAN, xrefs: 00E8F84B
1#INF, xrefs: 00E8F852
1#SNAN, xrefs: 00E8F844
1#IND, xrefs: 00E8F83D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 7b2ecedf697d8432a4a2b4558ebb1e1165ecc9a892d1e4b773916ec0f28af21d
Instruction ID: 78e2ff13e6c88eea26bcdb7863153ac8cd327e0ab95fd57f7b09a4e230449731
Opcode Fuzzy Hash: 7b2ecedf697d8432a4a2b4558ebb1e1165ecc9a892d1e4b773916ec0f28af21d
Instruction Fuzzy Hash: B9C22971E086288FDB29EE28DD407EAB7B5EB88305F1451EAD44DF7241E775AE818F40

Function 00EC648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EC64DC
CoInitialize.OLE32(00000000), ref: 00EC6639
CoCreateInstance.OLE32(00EEFCF8,00000000,00000001,00EEFB68,?), ref: 00EC6650
CoUninitialize.OLE32 ref: 00EC68D4

Strings

.lnk, xrefs: 00EC64BA, 00EC6524, 00EC65E0

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: d73261459bf368c09b34c3c05308ea8f5fd480c8e4a49344a426889abddb2499
Instruction ID: f8024bccde8d3a2e04f2ae79f63dd73e3378dfa14bd8f7085afd741727c5bd09
Opcode Fuzzy Hash: d73261459bf368c09b34c3c05308ea8f5fd480c8e4a49344a426889abddb2499
Instruction Fuzzy Hash: ECD16B716083019FC304DF24C991EABB7E8FF94305F10596DF595AB292DB31E90ACBA2

Function 00ED22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00ED22E8

Part of subcall function 00ECE4EC: GetWindowRect.USER32(?,?), ref: 00ECE504

GetDesktopWindow.USER32 ref: 00ED2312
GetWindowRect.USER32(00000000), ref: 00ED2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00ED2355
GetCursorPos.USER32(?), ref: 00ED2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00ED23DF

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 356b49bf6e009f2a8deeff744917c434cfb04e1f01212ed5b7ae93effe61d5d0
Instruction ID: d427b303ad15ae32afafd50d80287ddae2c4e27233ee72fd2c32146a54af6322
Opcode Fuzzy Hash: 356b49bf6e009f2a8deeff744917c434cfb04e1f01212ed5b7ae93effe61d5d0
Instruction Fuzzy Hash: C431EF72104356AFCB20DF15C844B9BB7E9FF84314F10191EFA94AB281DB34E90ACB92

Function 00EC9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00EC9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00EC9C8B

Part of subcall function 00EC3874: GetInputState.USER32 ref: 00EC38CB
Part of subcall function 00EC3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EC3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00EC9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00EC9C75

Strings

*.*, xrefs: 00EC9B5D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: d28420744aab2b9485337a4be03b219b712da1c60abf335f3ca15b6e45233f0c
Instruction ID: 3466857e0075808b1b841575790127617d59f75f5e3d5942f290cfca2d28e5cc
Opcode Fuzzy Hash: d28420744aab2b9485337a4be03b219b712da1c60abf335f3ca15b6e45233f0c
Instruction Fuzzy Hash: 93417F7190420AAFCF14DF64C989FEEBBF4EF05305F245459E805B2192DB319E89CB64

Function 00E6997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00E69BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E69BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00E69A4E
GetSysColor.USER32(0000000F), ref: 00E69B23
SetBkColor.GDI32(?,00000000), ref: 00E69B36

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 8990bda23832b3503666030a14734e1dd869082c1007ad6bc060a0f1ad792904
Instruction ID: 596b1f007ce220df0dbc43e581946cfb8609f127d28e5a0fd1fb67d3f54a9ee6
Opcode Fuzzy Hash: 8990bda23832b3503666030a14734e1dd869082c1007ad6bc060a0f1ad792904
Instruction Fuzzy Hash: 37A15B70148448AEE734DA7DAC98EBB36DDEB87388B14311AF042FB593CA35AD01D675

Function 00ED1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00ED307A
Part of subcall function 00ED304E: _wcslen.LIBCMT ref: 00ED309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00ED185D
WSAGetLastError.WSOCK32 ref: 00ED1884
bind.WSOCK32(00000000,?,00000010), ref: 00ED18DB
WSAGetLastError.WSOCK32 ref: 00ED18E6
closesocket.WSOCK32(00000000), ref: 00ED1915

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 43b27db6b3d08a99e4e9f11a2ade85df4892472a968954c23c20ba7c4d6d3650
Instruction ID: 3af708d5da71749d26a495e2258493d241bad7ec978234d366d1c14ba6c92cd5
Opcode Fuzzy Hash: 43b27db6b3d08a99e4e9f11a2ade85df4892472a968954c23c20ba7c4d6d3650
Instruction Fuzzy Hash: EB51E074A00210AFDB14EF24C886F2A77E5EB84318F189488F9157F3D3CA70AD428BA1

Function 00EE1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00EE1CC0
IsWindowEnabled.USER32 ref: 00EE1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00EE1CDB
IsIconic.USER32 ref: 00EE1CE9
IsZoomed.USER32 ref: 00EE1CF7

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: fb899c01b5ae92dbc34e141cbe14d5355e4a9f8dbad42e66dbf8b933cd417c92
Instruction ID: deb91a9cd8be3f502839b9f2a9810a5fc3c5f515490a3839517c8b5d9e87d983
Opcode Fuzzy Hash: fb899c01b5ae92dbc34e141cbe14d5355e4a9f8dbad42e66dbf8b933cd417c92
Instruction Fuzzy Hash: 1E21D8317402895FD7248F17C884B56BBD5EF85319B29A49CE845EB351C771DC86CB90

Function 00E58060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00E5843C
VUUU, xrefs: 00E95DF0
VUUU, xrefs: 00E583E8
ERCP, xrefs: 00E5813C
VUUU, xrefs: 00E583FA

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 298dc2fc9ac5d919c41ca8395de9f57178506be701be7e25d5278b727e205ecf
Instruction ID: 005af83ad8158112a3100183c6e23eda4bc43e8893dde156a7e19960de54c960
Opcode Fuzzy Hash: 298dc2fc9ac5d919c41ca8395de9f57178506be701be7e25d5278b727e205ecf
Instruction Fuzzy Hash: 81A28E71A0061ACBDF24CF58CA407EEB7B1BF54319F2495AAEC15B7284EB709D85CB90

Function 00E74CE8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00E828E9,(,00E74CBE,00000000,00F188B8,0000000C,00E74E15,(,00000002,00000000,?,00E828E9,00000003,00E82DF7,?,?), ref: 00E74D09
TerminateProcess.KERNEL32(00000000,?,00E828E9,00000003,00E82DF7,?,?,?,00E7E6D1,?,00F18A48,00000010,00E54F4A,?,?,00000000), ref: 00E74D10
ExitProcess.KERNEL32 ref: 00E74D22

Strings

(, xrefs: 00E74CEA

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID: (
API String ID: 1703294689-2063206799
Opcode ID: 08c5d67ff23cc44d70cf6770596fa7d500f03a4374f07aebbfd0aa19c928fba3
Instruction ID: e237c216f775c75649639be9be3a370e785204c28b52b6e5af579ded336f72bf
Opcode Fuzzy Hash: 08c5d67ff23cc44d70cf6770596fa7d500f03a4374f07aebbfd0aa19c928fba3
Instruction Fuzzy Hash: 5EE046B1000188AFCF21AFA5DD49A483B69EB41785B208014FD58AA162CB35ED42CB80

Function 00EDA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00EDA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00EDA6BA

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

Process32NextW.KERNEL32(00000000,?), ref: 00EDA79C
CloseHandle.KERNEL32(00000000), ref: 00EDA7AB

Part of subcall function 00E6CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00E93303,?), ref: 00E6CE8A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 19c1bd6ddc59f7dae4e8fe1e36289075fe21a18b20a6d43be4d5df3dae4fa7e0
Instruction ID: 79b9ed41e8b98b382e2a56de5235d927fc7d10a28210e92362e590bcb455335e
Opcode Fuzzy Hash: 19c1bd6ddc59f7dae4e8fe1e36289075fe21a18b20a6d43be4d5df3dae4fa7e0
Instruction Fuzzy Hash: BC518E71508300AFC710EF24D886A6BBBF8FF89754F00592DF985A7252EB30D909CB92

Function 00EBAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00EBAAAC
SetKeyboardState.USER32(00000080), ref: 00EBAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00EBAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00EBAB88

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: c60b57a70434f641c3a59bfbe365bbfe127c9cae687179f42bef4c0f03af744d
Instruction ID: c9272177fb3973e75209b9a93336472583a7ea872a162ac7d7aec7df7496a66b
Opcode Fuzzy Hash: c60b57a70434f641c3a59bfbe365bbfe127c9cae687179f42bef4c0f03af744d
Instruction Fuzzy Hash: 3E312430A40248AEFF358B658C85BFB7BE6AB44314F1C622AF1A1B61D1D3748985C762

Function 00ECCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00ECCE89
GetLastError.KERNEL32(?,00000000), ref: 00ECCEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00ECCEFE

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 6c840ff1b82fa89079a2fd6e2ada9be26bd82fa1dad05896292e45f40bdcb8a1
Instruction ID: 2eb15e516f8108f88a16baff273f6bb37330f8782b1845fcf7302668732a2077
Opcode Fuzzy Hash: 6c840ff1b82fa89079a2fd6e2ada9be26bd82fa1dad05896292e45f40bdcb8a1
Instruction Fuzzy Hash: 9B21BD71A007059FD720DFA5CA88FAA77F8EB01318F20941EE64AF6151E771EE4A8B50

Function 00EB8298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00EB82AA

Strings

(, xrefs: 00EB82F0
|, xrefs: 00EB82DA

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: dcdf3d8248cd40496af7ce0be13265210ee7b357403b0088a7b2131a7c0aa9ed
Instruction ID: 3aa7c572110ef9047a4c85ed8dfc26201ee8916a800e3cfeaf26ee5f9dff4a07
Opcode Fuzzy Hash: dcdf3d8248cd40496af7ce0be13265210ee7b357403b0088a7b2131a7c0aa9ed
Instruction Fuzzy Hash: 62324674A00605DFCB28CF19C180AAAB7F4FF48714B15D56EE49AEB3A1EB70E941CB40

Function 00EC5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00EC5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00EC5D17
FindClose.KERNEL32(?), ref: 00EC5D5F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: c4b0763cbabf7059410bd775d5ea14c9ff9b5ae8897ec128cbc5f809bebef455
Instruction ID: 006d09a4ced3d8a4d93da91130a63442f6678dd58b946bda94d38d69a4f56fc2
Opcode Fuzzy Hash: c4b0763cbabf7059410bd775d5ea14c9ff9b5ae8897ec128cbc5f809bebef455
Instruction Fuzzy Hash: 7F519935604B019FC704CF28C494E9ABBE4FF49314F14955DE95A9B3A2CB31F845CB91

Function 00E82622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00E8271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00E82724
UnhandledExceptionFilter.KERNEL32(?), ref: 00E82731

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6625c9f1c62bcdc452c013bcfadc12624dce31f2adc339acb65871e1069d3bd9
Instruction ID: 64eaafb91f22f9ae90785d747743daefaa204b325a0d1f62c09737e18bb9489d
Opcode Fuzzy Hash: 6625c9f1c62bcdc452c013bcfadc12624dce31f2adc339acb65871e1069d3bd9
Instruction Fuzzy Hash: 5731C27490121CABCB21DF69DD88798BBB8AF08310F5091EAE91CA6260E7309F858F44

Function 00EC51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00EC51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00EC5238
SetErrorMode.KERNEL32(00000000), ref: 00EC52A1

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 067b2234da4800a9a0d4ffb2368b7ece5ca97db3691fd1b6ec7729d011e115b7
Instruction ID: 108ce6a470de2043c5e6c9a694ee24a91e747f16f4b3e863365094ddec396cec
Opcode Fuzzy Hash: 067b2234da4800a9a0d4ffb2368b7ece5ca97db3691fd1b6ec7729d011e115b7
Instruction Fuzzy Hash: AE314D75A00618DFDB00DF54D884EADBBF4FF48318F189499E805AB362DB32E85ACB50

Function 00EB16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00E6FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00E70668
Part of subcall function 00E6FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00E70685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00EB170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00EB173A
GetLastError.KERNEL32 ref: 00EB174A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 6ab1e487a219c32b2d09da8932167c2cfb15d4aa29fb39fe322749431a5da5f5
Instruction ID: c92dbb2d449fd9da834f43f66941e635ec0df95ae12484c410360411f4b4049a
Opcode Fuzzy Hash: 6ab1e487a219c32b2d09da8932167c2cfb15d4aa29fb39fe322749431a5da5f5
Instruction Fuzzy Hash: 7A11C1B2400308AFD7189F54ECC6EABB7FDEB05764B20856EF05667241EB70BC428B60

Function 00EBD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00EBD608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00EBD645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00EBD650

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: c1f51982d7d5f89c29ed3cf177844e9bfcd8260c991646313c92084c118e9fd2
Instruction ID: 8f0d0b0558bc84e085cb2c85258ab013f41dcade0aa66359da4820fc2a4f0610
Opcode Fuzzy Hash: c1f51982d7d5f89c29ed3cf177844e9bfcd8260c991646313c92084c118e9fd2
Instruction Fuzzy Hash: 39112AB5A05228BFDB108B95AC85BEFBBBCEB45B50F108155F904F7294D6704A058BA1

Function 00EB1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00EB168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00EB16A1
FreeSid.ADVAPI32(?), ref: 00EB16B1

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 54024dca749e602ae528b8eca89efa8b0375d484e6fe943877176ac3224d6c6f
Instruction ID: 522a4c8c38597a42df9d9b020a74ed14d16125c4370693852a9e59aabf97132c
Opcode Fuzzy Hash: 54024dca749e602ae528b8eca89efa8b0375d484e6fe943877176ac3224d6c6f
Instruction Fuzzy Hash: 6DF0F47195030DFFDB00DFE59C89AAEBBBCEB08604F5045A5E501E6181E774AA489A50

Function 00E8C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 00E8C36C

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: f847261a6357e292530eb44fa99e84da9c6b362e5f8d118a1fe1c7f70b72af2a
Instruction ID: cc0715b98ecd15972efe7af71b7e94494ce9215aeea4346307e206c47932050e
Opcode Fuzzy Hash: f847261a6357e292530eb44fa99e84da9c6b362e5f8d118a1fe1c7f70b72af2a
Instruction Fuzzy Hash: 8F415C72500619AFCB20AFB9DC48DBB77B8EB85318F2041ADF90DE7180E6309D81CB60

Function 00EAD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00EAD28C

Strings

X64, xrefs: 00EAD2A8

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 1d76757a0cd34bc0cc06c91e21039f7d60c5ef32a31ee19bad049a0e0baa8e4d
Instruction ID: 66b44c45f04c58ba457740eff910440a92d12c82abaaccab33c0071e48f04ca4
Opcode Fuzzy Hash: 1d76757a0cd34bc0cc06c91e21039f7d60c5ef32a31ee19bad049a0e0baa8e4d
Instruction Fuzzy Hash: 33D0C9B480511DEECB90DB90ECC8DD9B37CBB14345F100151F506B2010D73095498F20

Function 00E7CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: eef50520199ba812a7269597768fe2fd90679d0c2db1f0f54b639670e20e43f6
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: F3021A71E002199BDF28CFA9D8806ADFBF5EF48314F25916ED919B7284D730AA41CB84

Function 00EC68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00EC6918
FindClose.KERNEL32(00000000), ref: 00EC6961

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 5f89b6b2d79942415a978583ba1d2c9b1863944da04f656b590d97862120896d
Instruction ID: 5a2d42895fb93a385ea4150b0c7c73649b2b21607aad9118730124fa0c0fc95c
Opcode Fuzzy Hash: 5f89b6b2d79942415a978583ba1d2c9b1863944da04f656b590d97862120896d
Instruction Fuzzy Hash: 9211BE316046009FC710CF29D885E16BBE1EF88329F14C69DF8699F2A2C731EC0ACB90

Function 00EC37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00ED4891,?,?,00000035,?), ref: 00EC37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00ED4891,?,?,00000035,?), ref: 00EC37F4

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 0ac6aa595dab43cb75e933c5185340e9032c9e49ada7c33bb77ba79128994357
Instruction ID: 18214fbca77aeec34a7ffa83b3840404f127e058bd3cf8ebbc3cf08ab7874c4d
Opcode Fuzzy Hash: 0ac6aa595dab43cb75e933c5185340e9032c9e49ada7c33bb77ba79128994357
Instruction Fuzzy Hash: 2FF0E5B17043296EEB2017B68D8DFEB7AAEEFC5761F100166F509F2291D9609909C6B0

Function 00EBB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00EBB25D
keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 00EBB270

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: d15606d81cc213e570a6ee09d87680ce9174ba114baa73f5b562490efcee42d5
Instruction ID: 14d5b3112cc07938dc8de99cb3d48288db298dd9b323dc04831649412ccc9a16
Opcode Fuzzy Hash: d15606d81cc213e570a6ee09d87680ce9174ba114baa73f5b562490efcee42d5
Instruction Fuzzy Hash: 09F01D7180428DAFDB059FA1C805BEE7BB4FF08309F10900AF965A91A1C379C6159F94

Function 00EB10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00EB11FC), ref: 00EB10D4
CloseHandle.KERNEL32(?,?,00EB11FC), ref: 00EB10E9

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 478467a6b0d6059f2c937bb3ff3671e25a23284107aa5dbbdb1853377b05a210
Instruction ID: fe2c4f57e193b32375883dac982e97fae8a24d1e3f73c4bb858f0344c9f6f711
Opcode Fuzzy Hash: 478467a6b0d6059f2c937bb3ff3671e25a23284107aa5dbbdb1853377b05a210
Instruction Fuzzy Hash: 1CE04F32048600AEE7252B11FC09E737BE9EB04320F20882EF4A5944B1DB626C91DB10

Function 00E5CAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00EA0C40

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 20cbf7bfd62bff979a69b42a001dff8aa2c5e8fa3f83308a97ca7ec1e0a8da72
Instruction ID: 010ddbd06e8c7ff0b4400f1837d811f8171aae4b4ac29cf3b108413a5b7d7639
Opcode Fuzzy Hash: 20cbf7bfd62bff979a69b42a001dff8aa2c5e8fa3f83308a97ca7ec1e0a8da72
Instruction Fuzzy Hash: B2327D709003189FCF14DF90C891AEDB7F5BF09309F24A859E806BB291DB75AD49CB61

Function 00E8676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00E86766,?,?,00000008,?,?,00E8FEFE,00000000), ref: 00E86998

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ea0f08656e9f2c39c7ff91d14e2807839de4818271710befb52f807457999b05
Instruction ID: 59d3c52daf52ec232c1fe24d876317fdfe35129e83cf81c609b80acc5a845000
Opcode Fuzzy Hash: ea0f08656e9f2c39c7ff91d14e2807839de4818271710befb52f807457999b05
Instruction Fuzzy Hash: 07B15C31510608DFD719DF28C48ABA57BE0FF45368F259698E89DDF2A2C335D991CB40

Function 00E6B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00EA851F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 43eb1187af79a5ac415ff698103f745655423cde2a4b9e41ba0d1b8de99b2b34
Instruction ID: 47e2a17401b5b5e8f4aac218fc7bad1cee9034cd153c80e6b9c9ce13a8164935
Opcode Fuzzy Hash: 43eb1187af79a5ac415ff698103f745655423cde2a4b9e41ba0d1b8de99b2b34
Instruction Fuzzy Hash: B6125071D002299BCB24CF58D9806EEB7F5FF48710F1491AAE859FB255EB309E85CB90

Function 00ECEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00ECEABD

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 690c0494e3d6518c583098a9dee7aba9c970b568af8281ec976c3815b47a8f6c
Instruction ID: 5576ebda30d3588b2498a5c941ce5e3d137c7226ad9951c750f5913d42e861d3
Opcode Fuzzy Hash: 690c0494e3d6518c583098a9dee7aba9c970b568af8281ec976c3815b47a8f6c
Instruction Fuzzy Hash: 3CE04F312002049FC710EF6AD844E9AF7EDAF987A0F10941AFC49EB351DB71E8458BA0

Function 00E709D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00E703EE), ref: 00E709DA

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6fbadebfdbc4d3e83cc38498297941364c20973d8e42a4645ff5fe2f9289d972
Instruction ID: ee06ace410c53cc56a991123ed557134f66e0cfb28374b877f4d4a00fc3301e8
Opcode Fuzzy Hash: 6fbadebfdbc4d3e83cc38498297941364c20973d8e42a4645ff5fe2f9289d972
Instruction Fuzzy Hash:

Function 00E7781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00E7798B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: b3546ebcb2bf917d7c79445c8e264985cdf9cc9be94e35a3ddce89c56d192c13
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 5351522160C715AAFB3C8568C95E7BE63D58B92308F18F919D9CEF7282C611DE42D393

Function 00E86DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe143bb4f700c44848a3332421e2ef88a388912d3000d9c21ddb094cd0252dd
Instruction ID: 93c643ae4fe275183c0ce7bd8259c8ea33a86e55c2470057c1dc3da87d2e2b2b
Opcode Fuzzy Hash: ffe143bb4f700c44848a3332421e2ef88a388912d3000d9c21ddb094cd0252dd
Instruction Fuzzy Hash: 8C322722D29F014DD723A635DC22335A649AFF73C5F25D737E85EB59A5EB29C4838200

Function 00E6CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd5ce7a1b2486e396ee5b1527e116bfb0ac317452effcc03f8e5621c68685397
Instruction ID: 0f20a873e68910db6b45ac776c50048e53729b268a5f1255745614246993e2b8
Opcode Fuzzy Hash: cd5ce7a1b2486e396ee5b1527e116bfb0ac317452effcc03f8e5621c68685397
Instruction Fuzzy Hash: 79323931A401158BCF28CF28D4906BDB7A1EF4E358F39A566D49ABF291D230FD81DB51

Function 00E57920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8ddeda5ee318335c289405a4f1ac205930503ce9290b1beabc8d4347bcf3c3
Instruction ID: 71b594a9f5e794ec2d9dba674ff63a602eb4db0e0e60b912297d49ba7288d4c8
Opcode Fuzzy Hash: 2b8ddeda5ee318335c289405a4f1ac205930503ce9290b1beabc8d4347bcf3c3
Instruction Fuzzy Hash: 1E22BEB1A00609DFDF14CF64D881AEEB7F6FF44304F106A29E856B7291EB36A954CB50

Function 00E591C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f14e299814d07732eb9efcf704c855abb48076273979b1e79f371d40898d72f
Instruction ID: 48ad7c1ab9b381303a90b35f3593fd62d9f9643b55a0907ef230889d8900d649
Opcode Fuzzy Hash: 8f14e299814d07732eb9efcf704c855abb48076273979b1e79f371d40898d72f
Instruction Fuzzy Hash: FD02B5B0A00209EBCF04DF64D881AEDBBF5FF44344F119569E916BB391EB31AA54CB91

Function 00E89EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aabce4bbad1404028bee1fd66dc21d1d8cbb447257bc8845461581025a34de7
Instruction ID: b530ce50fcbcefe63b2deb933e7e8062a21c7af7f65f9996213fcfeecebfbfab
Opcode Fuzzy Hash: 4aabce4bbad1404028bee1fd66dc21d1d8cbb447257bc8845461581025a34de7
Instruction Fuzzy Hash: EBB1F420D2AF414DD723A63A8831336B65CAFFB6D5F51D71BFC2A74D62EB2186878140

Function 00E71C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 8cb91547fdeb883e0700b15304d735d4cba0eeaf916d6b70084c73b6dc225959
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: E291AB322082E349DB2D863D853507DFFE19A923A631A57DED4FAEB1C1FE20C954D620

Function 00E71F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 898cca23fb3cf01668e32cde25f3dcc13c2a57cf930d44c5b5acd258e174a440
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 4091A9726091A30EDB2D423D843403EFFE15A923A531AA7DDD5FAEB1C5EE24C954E620

Function 00E719B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: fed2eecf0c41a6098a888e622165796c1eccf18bd2d8a31a42fbdbd2e0ec93da
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 7591D7722092E34EDB2D427E847407DFFE14A923A531AA7DDD4FAEA1C1FE14C654D620

Function 00E77A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ad621ed50835332725d019f5aab272fa96203192c0a72728485229968859d1
Instruction ID: d45f5ed80b6d16788f7116ee8ab4f5a91a2cdb68648d853c82de049e6eca6cf3
Opcode Fuzzy Hash: 24ad621ed50835332725d019f5aab272fa96203192c0a72728485229968859d1
Instruction Fuzzy Hash: 24619930348709A6EE389A288D95BFE63D6DF45308F10F91AE8CEFB281D6119E42C755

Function 00E77CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e485374d6d76ee6470356141848cbcc85f06a3a2bb995d7b0d5930cf3f8044
Instruction ID: 79547b639f5e0f26be568fa597fc31452d4ef89ae00016c9b71de2dbaef521fa
Opcode Fuzzy Hash: 21e485374d6d76ee6470356141848cbcc85f06a3a2bb995d7b0d5930cf3f8044
Instruction Fuzzy Hash: A761673124870962DA384A685955BBF2394DF5370CF10F85DEACEFB281EA12AD42C355

Function 00E71706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 38c9f696ef88be06102668c21ce634e73d1b151958ad46749b46d6eaeb00cb2b
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 0D8197325081E309EB2D863D853407EFFE15A923A531A97DED4FAEB1C1EE24C555E620

Function 00EC2046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f9ae970731b25a7f7f636daaf81b107e1911b79b0b18caf9df6461ef1657ac5
Instruction ID: 944c36aefd7c5dafad509c4a386e47ef21302805c073dec9a33a7c16e90cf191
Opcode Fuzzy Hash: 0f9ae970731b25a7f7f636daaf81b107e1911b79b0b18caf9df6461ef1657ac5
Instruction Fuzzy Hash: 7A2127327206158BDB28CF79C92367E73E5A754310F14862EE4A7D33C0DE3AA905DB80

Function 00E6D073 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 609d07b80a9732a13545a3985bdac3ef251c4adf8f903ade6ec6bdfc6ab6b6a9
Instruction ID: 612a481d528207501446a6be663935670a6174e5f083aac01ce1dd6f2bb93ca0
Opcode Fuzzy Hash: 609d07b80a9732a13545a3985bdac3ef251c4adf8f903ade6ec6bdfc6ab6b6a9
Instruction Fuzzy Hash: 1EF0D54200CEDA7BDB938621ACBB1947F73CCD7420228878B848406B8B87ED141DC353

Function 00ED2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00ED2B30
DeleteObject.GDI32(00000000), ref: 00ED2B43
DestroyWindow.USER32 ref: 00ED2B52
GetDesktopWindow.USER32 ref: 00ED2B6D
GetWindowRect.USER32(00000000), ref: 00ED2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00ED2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00ED2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00ED2CF8
GetClientRect.USER32(00000000,?), ref: 00ED2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00ED2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00ED2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00ED2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00ED2D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00ED2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00ED2D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00ED2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00ED2DA8
GlobalFree.KERNEL32(00000000), ref: 00ED2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00ED2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00EEFC38,00000000), ref: 00ED2DDB
GlobalFree.KERNEL32(00000000), ref: 00ED2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00ED2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00ED2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00ED2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00ED303F

Strings

, xrefs: 00ED2FC5
static, xrefs: 00ED2D3A, 00ED2E91
AutoIt v3, xrefs: 00ED2CF2
DISPLAY, xrefs: 00ED2EA2

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 67d68ca2eddf28a605136815f2d120a125e1d355e5bc4a106074cac621b7c4fd
Instruction ID: 6b09d378f2eb6422b6a99a26aa2b73cc8e40fa1affa9cabea786358a630a7539
Opcode Fuzzy Hash: 67d68ca2eddf28a605136815f2d120a125e1d355e5bc4a106074cac621b7c4fd
Instruction Fuzzy Hash: 51028C71A00209AFDB14DF65CC89EAE7BBAFF48711F108519F915BB2A1D770AD06CB60

Function 00EE70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00EE712F
GetSysColorBrush.USER32(0000000F), ref: 00EE7160
GetSysColor.USER32(0000000F), ref: 00EE716C
SetBkColor.GDI32(?,000000FF), ref: 00EE7186
SelectObject.GDI32(?,?), ref: 00EE7195
InflateRect.USER32(?,000000FF,000000FF), ref: 00EE71C0
GetSysColor.USER32(00000010), ref: 00EE71C8
CreateSolidBrush.GDI32(00000000), ref: 00EE71CF
FrameRect.USER32(?,?,00000000), ref: 00EE71DE
DeleteObject.GDI32(00000000), ref: 00EE71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00EE7230
FillRect.USER32(?,?,?), ref: 00EE7262
GetWindowLongW.USER32(?,000000F0), ref: 00EE7284

Part of subcall function 00EE73E8: GetSysColor.USER32(00000012), ref: 00EE7421
Part of subcall function 00EE73E8: SetTextColor.GDI32(?,?), ref: 00EE7425
Part of subcall function 00EE73E8: GetSysColorBrush.USER32(0000000F), ref: 00EE743B
Part of subcall function 00EE73E8: GetSysColor.USER32(0000000F), ref: 00EE7446
Part of subcall function 00EE73E8: GetSysColor.USER32(00000011), ref: 00EE7463
Part of subcall function 00EE73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00EE7471
Part of subcall function 00EE73E8: SelectObject.GDI32(?,00000000), ref: 00EE7482
Part of subcall function 00EE73E8: SetBkColor.GDI32(?,00000000), ref: 00EE748B
Part of subcall function 00EE73E8: SelectObject.GDI32(?,?), ref: 00EE7498
Part of subcall function 00EE73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00EE74B7
Part of subcall function 00EE73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00EE74CE
Part of subcall function 00EE73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00EE74DB

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 12bc244a297c4dfcf39e157c3c76d5f0f59094a63c9cff417faaacda59f6c260
Instruction ID: df23e688cf9363242d2026af5b91a83d644668ad92562b0bce47b5ddda3ebd90
Opcode Fuzzy Hash: 12bc244a297c4dfcf39e157c3c76d5f0f59094a63c9cff417faaacda59f6c260
Instruction Fuzzy Hash: F6A1B472009349AFD7009F61DC88E5B7BB9FF48320F201A19FAA2AA1E1D731D949DB51

Function 00E68D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00E68E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00EA6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00EA6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00EA6F43

Part of subcall function 00E68F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00E68BE8,?,00000000,?,?,?,?,00E68BBA,00000000,?), ref: 00E68FC5

SendMessageW.USER32(?,00001053), ref: 00EA6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00EA6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00EA6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00EA6FB7

Strings

0, xrefs: 00EA6DCF

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 68b2c96e56d2c823c1279a648394311a2f3b45d352a4819f1d5e259e0d5fa2d1
Instruction ID: d08dcd7e7eedd1ddef7427a72c665faeb869c83a5cd499d287963ee314973459
Opcode Fuzzy Hash: 68b2c96e56d2c823c1279a648394311a2f3b45d352a4819f1d5e259e0d5fa2d1
Instruction Fuzzy Hash: FA12CD34200241DFDB21CF24D988BA6B7E1FB5B304F18A569F485AF261CB32BC96DB51

Function 00ED2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00ED273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00ED286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00ED28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00ED28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00ED2900
GetClientRect.USER32(00000000,?), ref: 00ED290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00ED2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00ED2964
GetStockObject.GDI32(00000011), ref: 00ED2974
SelectObject.GDI32(00000000,00000000), ref: 00ED2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00ED2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00ED2991
DeleteDC.GDI32(00000000), ref: 00ED299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00ED29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00ED29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00ED2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00ED2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00ED2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00ED2A77
GetStockObject.GDI32(00000011), ref: 00ED2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00ED2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00ED2A97

Strings

static, xrefs: 00ED294F, 00ED2A71
AutoIt v3, xrefs: 00ED28F8
DISPLAY, xrefs: 00ED295A
msctls_progress32, xrefs: 00ED2A13

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: ab2620bb63c3301e58f139b92b37cf480fb63dd763df453a001a20633ad7072f
Instruction ID: 5db00fdba6f8c55a14b6319c8269ea129442c0e9395a9676651d51910af77628
Opcode Fuzzy Hash: ab2620bb63c3301e58f139b92b37cf480fb63dd763df453a001a20633ad7072f
Instruction Fuzzy Hash: 2DB16D71A00209AFEB24DF69DC85FAE7BB9FB08711F104519FA14EB290D770AD46CB54

Function 00EC4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00EC4AED
GetDriveTypeW.KERNEL32(?,00EECB68,?,\\.\,00EECC08), ref: 00EC4BCA
SetErrorMode.KERNEL32(00000000,00EECB68,?,\\.\,00EECC08), ref: 00EC4D36

Strings

SATA, xrefs: 00EC4CD0
1394, xrefs: 00EC4C9F
Network, xrefs: 00EC4C02
Removable, xrefs: 00EC4C10, 00EC4C15
Unknown, xrefs: 00EC4BED, 00EC4C83
SSA, xrefs: 00EC4CA6
\\.\, xrefs: 00EC4B3F
ATA, xrefs: 00EC4C98
USB, xrefs: 00EC4CB4
RAID, xrefs: 00EC4CBB
RAMDisk, xrefs: 00EC4BF4
iSCSI, xrefs: 00EC4CC2
Fibre, xrefs: 00EC4CAD
SSD, xrefs: 00EC4C4A
ATAPI, xrefs: 00EC4C91
CDROM, xrefs: 00EC4BFB
Fixed, xrefs: 00EC4C09
SAS, xrefs: 00EC4CC9
Virtual, xrefs: 00EC4CE5
MMC, xrefs: 00EC4CDE
PhysicalDrive, xrefs: 00EC4B76
FileBackedVirtual, xrefs: 00EC4CEC
SCSI, xrefs: 00EC4C8A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 52c69d92d10aad96543ded594de126de9eaf3967324829d23332b7be5d21a5e8
Instruction ID: 8e278ec6f22796c03c59d2520137bdf1b3ecd1f7839d243061001360c806f39a
Opcode Fuzzy Hash: 52c69d92d10aad96543ded594de126de9eaf3967324829d23332b7be5d21a5e8
Instruction Fuzzy Hash: CC61C5B16051059BEB04DF14DBA1FE9B7B0AB04305B20641DF806FB2E2DA33DD86EB42

Function 00EE73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00EE7421
SetTextColor.GDI32(?,?), ref: 00EE7425
GetSysColorBrush.USER32(0000000F), ref: 00EE743B
GetSysColor.USER32(0000000F), ref: 00EE7446
CreateSolidBrush.GDI32(?), ref: 00EE744B
GetSysColor.USER32(00000011), ref: 00EE7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00EE7471
SelectObject.GDI32(?,00000000), ref: 00EE7482
SetBkColor.GDI32(?,00000000), ref: 00EE748B
SelectObject.GDI32(?,?), ref: 00EE7498
InflateRect.USER32(?,000000FF,000000FF), ref: 00EE74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00EE74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00EE74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00EE752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00EE7554
InflateRect.USER32(?,000000FD,000000FD), ref: 00EE7572
DrawFocusRect.USER32(?,?), ref: 00EE757D
GetSysColor.USER32(00000011), ref: 00EE758E
SetTextColor.GDI32(?,00000000), ref: 00EE7596
DrawTextW.USER32(?,00EE70F5,000000FF,?,00000000), ref: 00EE75A8
SelectObject.GDI32(?,?), ref: 00EE75BF
DeleteObject.GDI32(?), ref: 00EE75CA
SelectObject.GDI32(?,?), ref: 00EE75D0
DeleteObject.GDI32(?), ref: 00EE75D5
SetTextColor.GDI32(?,?), ref: 00EE75DB
SetBkColor.GDI32(?,?), ref: 00EE75E5

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: a1fe712c320d05d87a1a6371f3a0b8ca7518d5d4108f50f6e5613d0a3e86c0f0
Instruction ID: c500fc546cfa3f3a235671d4e6b3ad7aaf124e2c5061683fb7d07b01b87e9245
Opcode Fuzzy Hash: a1fe712c320d05d87a1a6371f3a0b8ca7518d5d4108f50f6e5613d0a3e86c0f0
Instruction Fuzzy Hash: F1616A7290025CAFDB019FA5DC89EEEBFB9EB08320F214125F915BB2A1D7709945DF90

Function 00EE0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00EE1128
GetDesktopWindow.USER32 ref: 00EE113D
GetWindowRect.USER32(00000000), ref: 00EE1144
GetWindowLongW.USER32(?,000000F0), ref: 00EE1199
DestroyWindow.USER32(?), ref: 00EE11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00EE11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00EE120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00EE121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00EE1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00EE1245
IsWindowVisible.USER32(00000000), ref: 00EE12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00EE12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00EE12D0
GetWindowRect.USER32(00000000,?), ref: 00EE12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00EE130E
GetMonitorInfoW.USER32(00000000,?), ref: 00EE1328
CopyRect.USER32(?,?), ref: 00EE133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00EE13AA

Strings

0, xrefs: 00EE10D3
tooltips_class32, xrefs: 00EE11E6
(, xrefs: 00EE131B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 8d7a9a897ec3efa83a9acb11c032b2f2e51ee78b828964945888084b9a65af3e
Instruction ID: 31664ff1742f02f65a68563357e63edbf93e64c334c293f4902a21d9fe2ce93e
Opcode Fuzzy Hash: 8d7a9a897ec3efa83a9acb11c032b2f2e51ee78b828964945888084b9a65af3e
Instruction Fuzzy Hash: 38B1CF71604385AFD704DF65C884B6BBBE5FF88344F00995CF999AB261C731E849CB92

Function 00EE0241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00EE02E5
_wcslen.LIBCMT ref: 00EE031F
_wcslen.LIBCMT ref: 00EE0389
_wcslen.LIBCMT ref: 00EE03F1
_wcslen.LIBCMT ref: 00EE0475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00EE04C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00EE0504

Part of subcall function 00E6F9F2: _wcslen.LIBCMT ref: 00E6F9FD

Part of subcall function 00EB223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00EB2258
Part of subcall function 00EB223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00EB228A

Strings

SELECTALL, xrefs: 00EE0515
SELECTINVERT, xrefs: 00EE057E
SELECTCLEAR, xrefs: 00EE052D
GETSELECTEDCOUNT, xrefs: 00EE0470, 00EE048B
GETTEXT, xrefs: 00EE03EC, 00EE0407
GETITEMCOUNT, xrefs: 00EE0316, 00EE0337
DESELECT, xrefs: 00EE059C
GETSELECTED, xrefs: 00EE05E1
GETSUBITEMCOUNT, xrefs: 00EE0384, 00EE039F
FINDITEM, xrefs: 00EE0627
SELECT, xrefs: 00EE0548
VIEWCHANGE, xrefs: 00EE0675
ISSELECTED, xrefs: 00EE04DD

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: e900f5d63d8caeaa334a576d02c23eac6c4e08a3f9718a5949073e5419b3a6a6
Instruction ID: 3f4d649dc1962973f1d2d192fde3bbf098f74cf2533fc5d1f2ef9a1d80def7af
Opcode Fuzzy Hash: e900f5d63d8caeaa334a576d02c23eac6c4e08a3f9718a5949073e5419b3a6a6
Instruction Fuzzy Hash: 12E1C1312083858FC714EF25C55096AB3E6BFC8718B14695CF896BB3A6DB70ED85CB81

Function 00E68891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00E68968
GetSystemMetrics.USER32(00000007), ref: 00E68970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00E6899B
GetSystemMetrics.USER32(00000008), ref: 00E689A3
GetSystemMetrics.USER32(00000004), ref: 00E689C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00E689E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00E689F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00E68A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00E68A3C
GetClientRect.USER32(00000000,000000FF), ref: 00E68A5A
GetStockObject.GDI32(00000011), ref: 00E68A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00E68A81

Part of subcall function 00E6912D: GetCursorPos.USER32(?), ref: 00E69141
Part of subcall function 00E6912D: ScreenToClient.USER32(00000000,?), ref: 00E6915E
Part of subcall function 00E6912D: GetAsyncKeyState.USER32(00000001), ref: 00E69183
Part of subcall function 00E6912D: GetAsyncKeyState.USER32(00000002), ref: 00E6919D

SetTimer.USER32(00000000,00000000,00000028,00E690FC), ref: 00E68AA8

Strings

AutoIt v3 GUI, xrefs: 00E68A20

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 5fa4fb53fed760738a190d9dfc5a45847d4621af3689f1065f87002012e79850
Instruction ID: 07715f98c93e23cae5f17f5ddb66f564c8054b3635ab27e4b4de003e8960b107
Opcode Fuzzy Hash: 5fa4fb53fed760738a190d9dfc5a45847d4621af3689f1065f87002012e79850
Instruction Fuzzy Hash: 2EB18A71A4020A9FDF14DFA8DD85BAE3BB4FB49354F14522AFA15BB290DB30A841CF54

Function 00EB0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00EB1114
Part of subcall function 00EB10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00EB0B9B,?,?,?), ref: 00EB1120
Part of subcall function 00EB10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00EB0B9B,?,?,?), ref: 00EB112F
Part of subcall function 00EB10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00EB0B9B,?,?,?), ref: 00EB1136
Part of subcall function 00EB10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00EB114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00EB0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00EB0E29
GetLengthSid.ADVAPI32(?), ref: 00EB0E40
GetAce.ADVAPI32(?,00000000,?), ref: 00EB0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00EB0E96
GetLengthSid.ADVAPI32(?), ref: 00EB0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00EB0EB5
HeapAlloc.KERNEL32(00000000), ref: 00EB0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00EB0EDD
CopySid.ADVAPI32(00000000), ref: 00EB0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00EB0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00EB0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00EB0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EB0F6E
HeapFree.KERNEL32(00000000), ref: 00EB0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EB0F7E
HeapFree.KERNEL32(00000000), ref: 00EB0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EB0F8E
HeapFree.KERNEL32(00000000), ref: 00EB0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00EB0FA1
HeapFree.KERNEL32(00000000), ref: 00EB0FA8

Part of subcall function 00EB1193: GetProcessHeap.KERNEL32(00000008,00EB0BB1,?,00000000,?,00EB0BB1,?), ref: 00EB11A1
Part of subcall function 00EB1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00EB0BB1,?), ref: 00EB11A8
Part of subcall function 00EB1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00EB0BB1,?), ref: 00EB11B7

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 39e7c3ae3ed69d972c1094cbec19092dedd0f1dc90f16765d0a5725ba6976ca5
Instruction ID: 7bebaf020352923ae19670b87b24258b0ea07b6508b58bf1be78503da0c6b9ab
Opcode Fuzzy Hash: 39e7c3ae3ed69d972c1094cbec19092dedd0f1dc90f16765d0a5725ba6976ca5
Instruction Fuzzy Hash: E7715C72A0020AAFDF209FA5DC44BEFBBB8BF05314F149155F919BA191D731AA09CB60

Function 00EDC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00EDC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00EECC08,00000000,?,00000000,?,?), ref: 00EDC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00EDC5A4
_wcslen.LIBCMT ref: 00EDC5F4
_wcslen.LIBCMT ref: 00EDC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00EDC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00EDC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00EDC84D
RegCloseKey.ADVAPI32(?), ref: 00EDC881
RegCloseKey.ADVAPI32(00000000), ref: 00EDC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00EDC960

Strings

REG_SZ, xrefs: 00EDC644
REG_BINARY, xrefs: 00EDC913
REG_DWORD, xrefs: 00EDC804
REG_EXPAND_SZ, xrefs: 00EDC5CD
REG_QWORD, xrefs: 00EDC8C3
REG_MULTI_SZ, xrefs: 00EDC6F5

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 3073b2b6e769f817e11ad47f5a8ee38dae286099e47980d0ece42d156bd85fab
Instruction ID: 64fccd9316896a3b1db0f1aefaf83a43684a5f4a8ebfe4bf5bf30c410bfadbea
Opcode Fuzzy Hash: 3073b2b6e769f817e11ad47f5a8ee38dae286099e47980d0ece42d156bd85fab
Instruction Fuzzy Hash: 6D126A356042019FCB14DF14D891E2AB7E5EF88765F14985DF88AAB3A2DB31FC46CB81

Function 00EE091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00EE09C6
_wcslen.LIBCMT ref: 00EE0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00EE0A54
_wcslen.LIBCMT ref: 00EE0A8A
_wcslen.LIBCMT ref: 00EE0B06
_wcslen.LIBCMT ref: 00EE0B81

Part of subcall function 00E6F9F2: _wcslen.LIBCMT ref: 00E6F9FD

Part of subcall function 00EB2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00EB2BFA

Strings

EXPAND, xrefs: 00EE0BF8
GETSELECTED, xrefs: 00EE0C4E
SELECT, xrefs: 00EE0D11
UNCHECK, xrefs: 00EE0D3E
CHECK, xrefs: 00EE0A85, 00EE0AA0
GETTEXT, xrefs: 00EE0C97
ISCHECKED, xrefs: 00EE0CE1
GETITEMCOUNT, xrefs: 00EE0C1E
EXISTS, xrefs: 00EE0B7C, 00EE0B97
COLLAPSE, xrefs: 00EE0B01, 00EE0B1C
GETTOTALCOUNT, xrefs: 00EE09F2, 00EE0A17

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 957e93119a37fa9b088609ae9e328bf3df278e29eb0526757f51c5afe1d1f91d
Instruction ID: fd007306b7d9b94aa06c5eea14a6d6a56b1528c19e914f07bfbc29e962e811d6
Opcode Fuzzy Hash: 957e93119a37fa9b088609ae9e328bf3df278e29eb0526757f51c5afe1d1f91d
Instruction Fuzzy Hash: F6E19F312083858FC714EF25C45096AB7E1BF98318F14A95DF89ABB362D771ED85CB81

Function 00EDC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00EDB6AE,?,?), ref: 00EDC9B5
_wcslen.LIBCMT ref: 00EDC9F1
_wcslen.LIBCMT ref: 00EDCA68
_wcslen.LIBCMT ref: 00EDCA9E
_wcslen.LIBCMT ref: 00EDCAF9
_wcslen.LIBCMT ref: 00EDCB2F
_wcslen.LIBCMT ref: 00EDCB7F

Strings

HKEY_USERS, xrefs: 00EDCBDF
HKEY_CLASSES_ROOT, xrefs: 00EDCAF3, 00EDCAF8
HKEY_CURRENT_CONFIG, xrefs: 00EDCB79, 00EDCB7E
HKCR, xrefs: 00EDCB29, 00EDCB2E
HKU, xrefs: 00EDCBF0
HKEY_CURRENT_USER, xrefs: 00EDCBBD
HKEY_LOCAL_MACHINE, xrefs: 00EDCA62, 00EDCA67
HKCU, xrefs: 00EDCBCE
HKCC, xrefs: 00EDCBAC
HKLM, xrefs: 00EDCA98, 00EDCA9D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: a31b5bfe7a06716621e0d90500d2ef32dbee96ffda1d9a171fb450e88c16a26e
Instruction ID: 1765fb3f8045303095c70b777621cf354ce7bffd1922d761f04ce34ad0404652
Opcode Fuzzy Hash: a31b5bfe7a06716621e0d90500d2ef32dbee96ffda1d9a171fb450e88c16a26e
Instruction Fuzzy Hash: 4B71D63261016B8BCB20DE68C9515FA73A1EBA07D8F352527F85AB7385E631CD86D390

Function 00EE833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EE835A
_wcslen.LIBCMT ref: 00EE836E
_wcslen.LIBCMT ref: 00EE8391
_wcslen.LIBCMT ref: 00EE83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00EE83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00EE5BF2), ref: 00EE844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00EE8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00EE84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00EE8501
FreeLibrary.KERNEL32(?), ref: 00EE850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00EE851D
DestroyIcon.USER32(?,?,?,?,?,00EE5BF2), ref: 00EE852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00EE8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00EE8555

Strings

.icl, xrefs: 00EE8368
.dll, xrefs: 00EE83AB
.exe, xrefs: 00EE8388

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 24624d8760a5165acdc0c067bedbd3db72baace7e968d1ece753966a09de87cb
Instruction ID: 95d8f9e668cdb2704cf49590b7f47b3756d281e2353f88ba16f068cce61c2af4
Opcode Fuzzy Hash: 24624d8760a5165acdc0c067bedbd3db72baace7e968d1ece753966a09de87cb
Instruction Fuzzy Hash: 7E61DE71500249BEEB14DF66CD81BBE77A8FB04B11F105509F929FA1D1EF74A984C7A0

Function 00E57778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#notrayicon, xrefs: 00E577E7
#cs, xrefs: 00E57873, 00E578C5
#pragma compile, xrefs: 00E577D3
Unterminated group of comments, xrefs: 00E9528C
#OnAutoItStartRegister, xrefs: 00E57817
#comments-start, xrefs: 00E5785F, 00E578B1
#include-once, xrefs: 00E5782F
Cannot parse #include, xrefs: 00E95279
#requireadmin, xrefs: 00E577FF
Bad directive syntax error, xrefs: 00E9519A
#include, xrefs: 00E57847
#ce, xrefs: 00E578ED
", xrefs: 00E95153
', xrefs: 00E95169
#comments-end, xrefs: 00E578D9

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: e401f17ec2285d00cc582eeae02239e4782e56750aba66102eec73744253da4f
Instruction ID: 885bee351ea2fc01bfc13e958bd3305535cff3d98f363db3f47b46f97f3365fb
Opcode Fuzzy Hash: e401f17ec2285d00cc582eeae02239e4782e56750aba66102eec73744253da4f
Instruction Fuzzy Hash: A281F571644615BBDB21AF61FC42FEE37A8AF14301F106825FC88BA192EB70DA25C791

Function 00EC3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00EC3EF8
_wcslen.LIBCMT ref: 00EC3F03
_wcslen.LIBCMT ref: 00EC3F5A
_wcslen.LIBCMT ref: 00EC3F98
GetDriveTypeW.KERNEL32(?), ref: 00EC3FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00EC401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00EC4059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00EC4087

Strings

close cd wait, xrefs: 00EC4072
type cdaudio alias cd wait, xrefs: 00EC4001
close, xrefs: 00EC3EFE, 00EC3F18
open, xrefs: 00EC3F54, 00EC3F59
open , xrefs: 00EC3FE5
wait, xrefs: 00EC4044
closed, xrefs: 00EC3F08, 00EC3F2D, 00EC3F46, 00EC3F7E, 00EC3F97
set cd door , xrefs: 00EC4028

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: dd8e293d158f5dd3a6ba45a75b25eb6e02ccc66912b94384a2cce15a197f58fa
Instruction ID: 74d1eafa26b4385f4fd02fc51a296cd5f7f3e04236cba23cf783ea01aa727ae2
Opcode Fuzzy Hash: dd8e293d158f5dd3a6ba45a75b25eb6e02ccc66912b94384a2cce15a197f58fa
Instruction Fuzzy Hash: CC71E0716042018FC310EF34C9919AAB7F4EF94758F109D2DF995A7291EB32DD4ACB92

Function 00EB5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00EB5A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00EB5A40
SetWindowTextW.USER32(?,?), ref: 00EB5A57
GetDlgItem.USER32(?,000003EA), ref: 00EB5A6C
SetWindowTextW.USER32(00000000,?), ref: 00EB5A72
GetDlgItem.USER32(?,000003E9), ref: 00EB5A82
SetWindowTextW.USER32(00000000,?), ref: 00EB5A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00EB5AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00EB5AC3
GetWindowRect.USER32(?,?), ref: 00EB5ACC
_wcslen.LIBCMT ref: 00EB5B33
SetWindowTextW.USER32(?,?), ref: 00EB5B6F
GetDesktopWindow.USER32 ref: 00EB5B75
GetWindowRect.USER32(00000000), ref: 00EB5B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00EB5BD3
GetClientRect.USER32(?,?), ref: 00EB5BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00EB5C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00EB5C2F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: e98130810eb3d318d6d3ae5cde3be4d479dff58daad64f112dc157a3e2d1c294
Instruction ID: fb2990e2cc2db2eee6887b534015db3a1012c7d188bd8233f5d75cdf08d19bf1
Opcode Fuzzy Hash: e98130810eb3d318d6d3ae5cde3be4d479dff58daad64f112dc157a3e2d1c294
Instruction Fuzzy Hash: F3717A32900B09AFDB20DFA9CE85BAFBBF5FF48704F105918E582B65A0D771A944CB50

Function 00ECFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00ECFE27
LoadCursorW.USER32(00000000,00007F8A), ref: 00ECFE32
LoadCursorW.USER32(00000000,00007F00), ref: 00ECFE3D
LoadCursorW.USER32(00000000,00007F03), ref: 00ECFE48
LoadCursorW.USER32(00000000,00007F8B), ref: 00ECFE53
LoadCursorW.USER32(00000000,00007F01), ref: 00ECFE5E
LoadCursorW.USER32(00000000,00007F81), ref: 00ECFE69
LoadCursorW.USER32(00000000,00007F88), ref: 00ECFE74
LoadCursorW.USER32(00000000,00007F80), ref: 00ECFE7F
LoadCursorW.USER32(00000000,00007F86), ref: 00ECFE8A
LoadCursorW.USER32(00000000,00007F83), ref: 00ECFE95
LoadCursorW.USER32(00000000,00007F85), ref: 00ECFEA0
LoadCursorW.USER32(00000000,00007F82), ref: 00ECFEAB
LoadCursorW.USER32(00000000,00007F84), ref: 00ECFEB6
LoadCursorW.USER32(00000000,00007F04), ref: 00ECFEC1
LoadCursorW.USER32(00000000,00007F02), ref: 00ECFECC
GetCursorInfo.USER32(?), ref: 00ECFEDC
GetLastError.KERNEL32 ref: 00ECFF1E

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: cc4cf65b5659498ec9afd677674bdd551ddd469bbaf9d6be63b2dd3965e0f487
Instruction ID: 6e318100f34f86858e15f120297d6e6f5892d8bbf7010873e05d31d076c4037a
Opcode Fuzzy Hash: cc4cf65b5659498ec9afd677674bdd551ddd469bbaf9d6be63b2dd3965e0f487
Instruction Fuzzy Hash: 394183B0E043596EDB109FBA8C85D5EBFE9FF04314B50452AF118EB281DB789802CE90

Function 00E700C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00E700C6

Part of subcall function 00E700ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00F2070C,00000FA0,561DB956,?,?,?,?,00E923B3,000000FF), ref: 00E7011C
Part of subcall function 00E700ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00E923B3,000000FF), ref: 00E70127
Part of subcall function 00E700ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00E923B3,000000FF), ref: 00E70138
Part of subcall function 00E700ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00E7014E
Part of subcall function 00E700ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00E7015C
Part of subcall function 00E700ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00E7016A
Part of subcall function 00E700ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00E70195
Part of subcall function 00E700ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00E701A0

___scrt_fastfail.LIBCMT ref: 00E700E7

Part of subcall function 00E700A3: __onexit.LIBCMT ref: 00E700A9

Strings

WakeAllConditionVariable, xrefs: 00E70162
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00E70122
SleepConditionVariableCS, xrefs: 00E70154
kernel32.dll, xrefs: 00E70133
InitializeConditionVariable, xrefs: 00E70148

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 599c620919ae9cfc6ee93dac478fe0795007e97bc56e957c7130ebc0b7e3a243
Instruction ID: f3fc4ae2f661c979a2488eb6ad0000e3d1320b4b278934be11476310b1f10713
Opcode Fuzzy Hash: 599c620919ae9cfc6ee93dac478fe0795007e97bc56e957c7130ebc0b7e3a243
Instruction Fuzzy Hash: B1212932A42759EFE7209B65BC45B6A37E4DB04B65F10A139F805F7291DF6098008A91

Function 00EB30F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EB318D
_wcslen.LIBCMT ref: 00EB31F8

Strings

CLASSNN, xrefs: 00EB31F3, 00EB3204
INSTANCE, xrefs: 00EB3453
NAME, xrefs: 00EB3335, 00EB3346
REGEXPCLASS, xrefs: 00EB3255, 00EB3266
CLASS, xrefs: 00EB3188, 00EB31A5
TEXT, xrefs: 00EB347C

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: ef1b7876aa4095a3f03f95f48881299fac24458475369506a7c902bd1a7dd6fe
Instruction ID: 30b990990d221534038b492b310a7f56977cb7046c18532977a3d24dfa4ceb7b
Opcode Fuzzy Hash: ef1b7876aa4095a3f03f95f48881299fac24458475369506a7c902bd1a7dd6fe
Instruction Fuzzy Hash: 2BE1F831A00516EBCB28DFB8C4526EFF7B4BF44714F54A219E466B7250DB309E899790

Function 00EC44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00EECC08), ref: 00EC4527
_wcslen.LIBCMT ref: 00EC453B
_wcslen.LIBCMT ref: 00EC4599
_wcslen.LIBCMT ref: 00EC45F4
_wcslen.LIBCMT ref: 00EC463F
_wcslen.LIBCMT ref: 00EC46A7

Part of subcall function 00E6F9F2: _wcslen.LIBCMT ref: 00E6F9FD

GetDriveTypeW.KERNEL32(?,00F16BF0,00000061), ref: 00EC4743

Strings

ramdisk, xrefs: 00EC46F1
all, xrefs: 00EC4531, 00EC4536
fixed, xrefs: 00EC4635, 00EC463A
cdrom, xrefs: 00EC458F, 00EC4594
network, xrefs: 00EC469D, 00EC46A2
removable, xrefs: 00EC45EA, 00EC45EF
unknown, xrefs: 00EC4708

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: f3cfff6db8f7ae0a2d039f25965d413d04d906e2029028a01730ce3bc9e2dea1
Instruction ID: 1574e8c26270f20ec229e60ee957ce0403b654d6b176ed642069c3d501547035
Opcode Fuzzy Hash: f3cfff6db8f7ae0a2d039f25965d413d04d906e2029028a01730ce3bc9e2dea1
Instruction Fuzzy Hash: DEB122B16083029FC310DF28C9A0EAAB7E4AFA5728F50691DF496E72D5D731D846CB52

Function 00ED3FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00EECC08), ref: 00ED40BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00ED40CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00EECC08), ref: 00ED40F2
FreeLibrary.KERNEL32(00000000,?,00EECC08), ref: 00ED413E
StringFromGUID2.OLE32(?,?,00000028,?,00EECC08), ref: 00ED41A8
SysFreeString.OLEAUT32(00000009), ref: 00ED4262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00ED42C8
SysFreeString.OLEAUT32(?), ref: 00ED42F2

Strings

kernel32.dll, xrefs: 00ED40B6
GetModuleHandleExW, xrefs: 00ED40C7

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: 1185881d275300a54ea04ba267804b9d2ae9e12bdca738820c714876ddb2e576
Instruction ID: 339f4c2009bb197da7d9c92d34a3998bb88ece57b881437289d70d0f5fef06a5
Opcode Fuzzy Hash: 1185881d275300a54ea04ba267804b9d2ae9e12bdca738820c714876ddb2e576
Instruction Fuzzy Hash: 17124CB1A00109EFDB14DF94C884EAEB7B5FF55318F249099F915AB291C731ED86CBA0

Function 00E5326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00F21990), ref: 00E92F8D
GetMenuItemCount.USER32(00F21990), ref: 00E9303D
GetCursorPos.USER32(?), ref: 00E93081
SetForegroundWindow.USER32(00000000), ref: 00E9308A
TrackPopupMenuEx.USER32(00F21990,00000000,?,00000000,00000000,00000000), ref: 00E9309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00E930A9

Strings

0, xrefs: 00E5327D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 02df5163c957cee912005d2344b1c9d515e3273f903e04f0e5d5244d0d30a886
Instruction ID: bc3d6db996d43e65f3997186425a370115ea15f452b6100ac802b7d122d95afe
Opcode Fuzzy Hash: 02df5163c957cee912005d2344b1c9d515e3273f903e04f0e5d5244d0d30a886
Instruction Fuzzy Hash: 0D71EB70640249BEEF218F75CC89FAABF64FF05368F20521AFA157A1E0C7B1A914DB50

Function 00EE6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00EE6DEB

Part of subcall function 00E56B57: _wcslen.LIBCMT ref: 00E56B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00EE6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00EE6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00EE6E94
DestroyWindow.USER32(?), ref: 00EE6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00E50000,00000000), ref: 00EE6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00EE6EFD
GetDesktopWindow.USER32 ref: 00EE6F16
GetWindowRect.USER32(00000000), ref: 00EE6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00EE6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00EE6F4D

Part of subcall function 00E69944: GetWindowLongW.USER32(?,000000EB), ref: 00E69952

Strings

tooltips_class32, xrefs: 00EE6E58, 00EE6EDD
0, xrefs: 00EE6D98

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 9e734c49676277487cc43d1a364a8c72e858430f48802d5a925321d9c9549d4b
Instruction ID: 50cb9bb394f968497aac517deb891dc2d8c738e135058e4a0943780a727ce89f
Opcode Fuzzy Hash: 9e734c49676277487cc43d1a364a8c72e858430f48802d5a925321d9c9549d4b
Instruction Fuzzy Hash: C7718C70104389AFDB20CF19D844AAABBF9FB99748F14141DF989A7261C770ED4ADB12

Function 00EE911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E69BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E69BB2

DragQueryPoint.SHELL32(?,?), ref: 00EE9147

Part of subcall function 00EE7674: ClientToScreen.USER32(?,?), ref: 00EE769A
Part of subcall function 00EE7674: GetWindowRect.USER32(?,?), ref: 00EE7710
Part of subcall function 00EE7674: PtInRect.USER32(?,?,00EE8B89), ref: 00EE7720

SendMessageW.USER32(?,000000B0,?,?), ref: 00EE91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00EE91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00EE91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00EE9225
SendMessageW.USER32(?,000000B0,?,?), ref: 00EE923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00EE9255
SendMessageW.USER32(?,000000B1,?,?), ref: 00EE9277
DragFinish.SHELL32(?), ref: 00EE927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00EE9371

Strings

@GUI_DROPID, xrefs: 00EE929E
@GUI_DRAGFILE, xrefs: 00EE9320
@GUI_DRAGID, xrefs: 00EE92E9

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 59596ad9753fe26706a30bb611bfa5a80eebe14b89dc006ef3be600fa1de2147
Instruction ID: aee838239df62bd3f1978e4ba6a8ccdfd61e6da1fd9b45bec0d48acd6102e507
Opcode Fuzzy Hash: 59596ad9753fe26706a30bb611bfa5a80eebe14b89dc006ef3be600fa1de2147
Instruction Fuzzy Hash: DC618A71108345AFC701EF61DC85DAFBBE8FF88750F10192DF995A61A2DB309A49CB52

Function 00ECC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00ECC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00ECC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00ECC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00ECC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00ECC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00ECC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00ECC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00ECC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00ECC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00ECC5F0
InternetCloseHandle.WININET(00000000), ref: 00ECC5FB

Strings

, xrefs: 00ECC575

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 48238918ebad6d20ddadfa01c21c62bdda5d24bb35d62a95870215d40359c5eb
Instruction ID: 135345eeb7d052912b0a2376b070f6e5f23ca6e0e2536df65fca21d5e3d4176a
Opcode Fuzzy Hash: 48238918ebad6d20ddadfa01c21c62bdda5d24bb35d62a95870215d40359c5eb
Instruction Fuzzy Hash: 64515FB1500648BFDB218F65CA88FAB7BFCFF08748F20541EF959A6150D731E94A9B60

Function 00EE856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00EE8592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00EE85A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00EE85AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00EE85BA
GlobalLock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00EE85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00EE85D7
GlobalUnlock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00EE85E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00EE85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00EE85F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,00EEFC38,?), ref: 00EE8611
GlobalFree.KERNEL32(00000000), ref: 00EE8621
GetObjectW.GDI32(?,00000018,?), ref: 00EE8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00EE8671
DeleteObject.GDI32(?), ref: 00EE8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00EE86AF

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: de9dc9591f5547eced2fdbf37129086e838418542393746f165bc4bb0d6fa4ec
Instruction ID: cd81f64b3f4d74d719f811cada26bf7cbcead8ab3722803348f94e5b9c77bf4a
Opcode Fuzzy Hash: de9dc9591f5547eced2fdbf37129086e838418542393746f165bc4bb0d6fa4ec
Instruction Fuzzy Hash: 8D412C75600249AFDB11DFA6DD88EAA7BB8EF89715F204058F919FB260DB309905CB20

Function 00EC14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00EC1502
VariantCopy.OLEAUT32(?,?), ref: 00EC150B
VariantClear.OLEAUT32(?), ref: 00EC1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00EC15FB
VarR8FromDec.OLEAUT32(?,?), ref: 00EC1657
VariantInit.OLEAUT32(?), ref: 00EC1708
SysFreeString.OLEAUT32(?), ref: 00EC178C
VariantClear.OLEAUT32(?), ref: 00EC17D8
VariantClear.OLEAUT32(?), ref: 00EC17E7
VariantInit.OLEAUT32(00000000), ref: 00EC1823

Strings

Default, xrefs: 00EC16AF
%4d%02d%02d%02d%02d%02d, xrefs: 00EC1625

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 3d14121091897bb7aa91112638c9573af95705ed7475bae28f42840cf026c1d7
Instruction ID: 70b4c8ed47d4d252382183757f5085d7b381aba4ee3c7a265107efad51d382a5
Opcode Fuzzy Hash: 3d14121091897bb7aa91112638c9573af95705ed7475bae28f42840cf026c1d7
Instruction Fuzzy Hash: 92D1F131A00204DBCB009F65E985FA9B7F1BF46700F64909AF806BB282DB32EC46DB51

Function 00EDB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

Part of subcall function 00EDC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00EDB6AE,?,?), ref: 00EDC9B5
Part of subcall function 00EDC998: _wcslen.LIBCMT ref: 00EDC9F1
Part of subcall function 00EDC998: _wcslen.LIBCMT ref: 00EDCA68
Part of subcall function 00EDC998: _wcslen.LIBCMT ref: 00EDCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00EDB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00EDB772
RegDeleteValueW.ADVAPI32(?,?), ref: 00EDB80A
RegCloseKey.ADVAPI32(?), ref: 00EDB87E
RegCloseKey.ADVAPI32(?), ref: 00EDB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00EDB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00EDB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00EDB922
FreeLibrary.KERNEL32(00000000), ref: 00EDB983
RegCloseKey.ADVAPI32(00000000), ref: 00EDB994

Strings

RegDeleteKeyExW, xrefs: 00EDB8FE
advapi32.dll, xrefs: 00EDB8ED

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 03e80376f95acbdbe2216e128f3f66e42eeaa9208ed95a3a3f1875a06141b0a7
Instruction ID: 97dd4c1e7a5def9af9a68ab8875519f05d85729c11a2f7f3e7707b9b95582e67
Opcode Fuzzy Hash: 03e80376f95acbdbe2216e128f3f66e42eeaa9208ed95a3a3f1875a06141b0a7
Instruction Fuzzy Hash: DAC19C34204241EFD714DF14C494F2ABBE1EF84318F25A95DF49A6B3A2DB31E84ACB91

Function 00ED255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00ED25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00ED25E8
CreateCompatibleDC.GDI32(?), ref: 00ED25F4
SelectObject.GDI32(00000000,?), ref: 00ED2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00ED266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00ED26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00ED26D0
SelectObject.GDI32(?,?), ref: 00ED26D8
DeleteObject.GDI32(?), ref: 00ED26E1
DeleteDC.GDI32(?), ref: 00ED26E8
ReleaseDC.USER32(00000000,?), ref: 00ED26F3

Strings

(, xrefs: 00ED268D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: f2a99b80388eca35d9d74035d672a1cdb039062bd2dbcb67d542386d3dfc5ae6
Instruction ID: 98e661e421d8f1d7f806d81a85367cbe64c8e2fcd3b9db099bd170729c489dc4
Opcode Fuzzy Hash: f2a99b80388eca35d9d74035d672a1cdb039062bd2dbcb67d542386d3dfc5ae6
Instruction Fuzzy Hash: 8961C275D00219EFCB14CFA4D884AAEBBF5FF58310F20852AEA55B7350D770A9528F90

Function 00E8DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00E8DAA1

Part of subcall function 00E8D63C: _free.LIBCMT ref: 00E8D659
Part of subcall function 00E8D63C: _free.LIBCMT ref: 00E8D66B
Part of subcall function 00E8D63C: _free.LIBCMT ref: 00E8D67D
Part of subcall function 00E8D63C: _free.LIBCMT ref: 00E8D68F
Part of subcall function 00E8D63C: _free.LIBCMT ref: 00E8D6A1
Part of subcall function 00E8D63C: _free.LIBCMT ref: 00E8D6B3
Part of subcall function 00E8D63C: _free.LIBCMT ref: 00E8D6C5
Part of subcall function 00E8D63C: _free.LIBCMT ref: 00E8D6D7
Part of subcall function 00E8D63C: _free.LIBCMT ref: 00E8D6E9
Part of subcall function 00E8D63C: _free.LIBCMT ref: 00E8D6FB
Part of subcall function 00E8D63C: _free.LIBCMT ref: 00E8D70D
Part of subcall function 00E8D63C: _free.LIBCMT ref: 00E8D71F
Part of subcall function 00E8D63C: _free.LIBCMT ref: 00E8D731

_free.LIBCMT ref: 00E8DA96

Part of subcall function 00E829C8: HeapFree.KERNEL32(00000000,00000000,?,00E8D7D1,00000000,00000000,00000000,00000000,?,00E8D7F8,00000000,00000007,00000000,?,00E8DBF5,00000000), ref: 00E829DE
Part of subcall function 00E829C8: GetLastError.KERNEL32(00000000,?,00E8D7D1,00000000,00000000,00000000,00000000,?,00E8D7F8,00000000,00000007,00000000,?,00E8DBF5,00000000,00000000), ref: 00E829F0

_free.LIBCMT ref: 00E8DAB8
_free.LIBCMT ref: 00E8DACD
_free.LIBCMT ref: 00E8DAD8
_free.LIBCMT ref: 00E8DAFA
_free.LIBCMT ref: 00E8DB0D
_free.LIBCMT ref: 00E8DB1B
_free.LIBCMT ref: 00E8DB26
_free.LIBCMT ref: 00E8DB5E
_free.LIBCMT ref: 00E8DB65
_free.LIBCMT ref: 00E8DB82
_free.LIBCMT ref: 00E8DB9A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 73a061b0872f049555148ba1f9d2daa6ae1e5b72c95af8dacd88537fd67e5703
Instruction ID: 2c1a858b3cf113630764c185195f7932a942b2e992f4d6d80ef9129c8e4d1f11
Opcode Fuzzy Hash: 73a061b0872f049555148ba1f9d2daa6ae1e5b72c95af8dacd88537fd67e5703
Instruction Fuzzy Hash: EB315A316486049FEB26BA39EC45B5A77E9FF40324F226459E54CF71D1DE35EC808720

Function 00EB365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00EB369C
_wcslen.LIBCMT ref: 00EB36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00EB3797
GetClassNameW.USER32(?,?,00000400), ref: 00EB380C
GetDlgCtrlID.USER32(?), ref: 00EB385D
GetWindowRect.USER32(?,?), ref: 00EB3882
GetParent.USER32(?), ref: 00EB38A0
ScreenToClient.USER32(00000000), ref: 00EB38A7
GetClassNameW.USER32(?,?,00000100), ref: 00EB3921
GetWindowTextW.USER32(?,?,00000400), ref: 00EB395D

Strings

%s%u, xrefs: 00EB3734

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: e3d21d277f50d98ce5405ac99e13b3d941439654071ec91ea322c07a32e8d72e
Instruction ID: 3fba7b6a0e478a1f0852e2fe5fc9069c6d18998433e44653bf46d87131ebb8db
Opcode Fuzzy Hash: e3d21d277f50d98ce5405ac99e13b3d941439654071ec91ea322c07a32e8d72e
Instruction Fuzzy Hash: C691CF71204606AFD719DF34C886BEBB7E8FF44344F109629F999E2190DB30EA49CB91

Function 00EB4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00EB4994
GetWindowTextW.USER32(?,?,00000400), ref: 00EB49DA
_wcslen.LIBCMT ref: 00EB49EB
CharUpperBuffW.USER32(?,00000000), ref: 00EB49F7
_wcsstr.LIBVCRUNTIME ref: 00EB4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00EB4A64
GetWindowTextW.USER32(?,?,00000400), ref: 00EB4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00EB4AE6
GetClassNameW.USER32(?,?,00000400), ref: 00EB4B20
GetWindowRect.USER32(?,?), ref: 00EB4B8B

Strings

ThumbnailClass, xrefs: 00EB4A6F, 00EB4AF1

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: f89afc729b33aa59e8aa88c5ffb44c63bdcaa501f9bf9ff5cd6e7b5300939ab6
Instruction ID: 57e88dbf0f9480f46569529e5e051e8bb9b66c170efc5bc8dd82b882edeadb93
Opcode Fuzzy Hash: f89afc729b33aa59e8aa88c5ffb44c63bdcaa501f9bf9ff5cd6e7b5300939ab6
Instruction Fuzzy Hash: 2B9191B10042069FDB05DF14C985BEB77E8EF84718F04A469FE85AA197EB30ED45CBA1

Function 00EE8D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E69BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E69BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00EE8D5A
GetFocus.USER32 ref: 00EE8D6A
GetDlgCtrlID.USER32(00000000), ref: 00EE8D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00EE8E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00EE8ECF
GetMenuItemCount.USER32(?), ref: 00EE8EEC
GetMenuItemID.USER32(?,00000000), ref: 00EE8EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00EE8F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00EE8F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00EE8FA1

Strings

0, xrefs: 00EE8E9F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 3904879021fa4c23cc4e10b531c33d11b5e3b9bcf33af761edca569c11a5d9b1
Instruction ID: 8d828af274f82e4290ed204c23a1e4d08a20a8a0420d7b979574247dfc9ecf9a
Opcode Fuzzy Hash: 3904879021fa4c23cc4e10b531c33d11b5e3b9bcf33af761edca569c11a5d9b1
Instruction Fuzzy Hash: AB81E2716043899FD710CF16DD84AAB7BE9FB88318F14191DF988B72A1DB30D905CB62

Function 00EBDC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00EBDC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00EBDC46
_wcslen.LIBCMT ref: 00EBDC50
_wcsstr.LIBVCRUNTIME ref: 00EBDCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00EBDCBC

Strings

%u.%u.%u.%u, xrefs: 00EBDD9A
DefaultLangCodepage, xrefs: 00EBDD1F
\VarFileInfo\Translation, xrefs: 00EBDCB4
04090000, xrefs: 00EBDCF2
StringFileInfo\, xrefs: 00EBDC8F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 8911d5b8083d433a91e6d7f80a3181dea0afd91270730c62a5de587b3cef2a38
Instruction ID: 4f21421a12899463a58e4cb510f3670e5d6aaf07fa36f516d337c3c2609ebed7
Opcode Fuzzy Hash: 8911d5b8083d433a91e6d7f80a3181dea0afd91270730c62a5de587b3cef2a38
Instruction Fuzzy Hash: 4C4122329442057ADB00A775AC47EFF7BACEF41760F10616AF904F6183FB71990296A5

Function 00EDCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00EDCC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00EDCC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00EDCD48

Part of subcall function 00EDCC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00EDCCAA
Part of subcall function 00EDCC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00EDCCBD
Part of subcall function 00EDCC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00EDCCCF
Part of subcall function 00EDCC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00EDCD05
Part of subcall function 00EDCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00EDCD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00EDCCF3

Strings

RegDeleteKeyExW, xrefs: 00EDCCC9
advapi32.dll, xrefs: 00EDCCB8

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: c5d1a2dd17fb317e7f809359c64cb22e49a81bf950f6bef9c653b1de6acb0047
Instruction ID: 326cab36a76e0922163b5cde1b842f96498120c478246235938ea07cb1b4fe5f
Opcode Fuzzy Hash: c5d1a2dd17fb317e7f809359c64cb22e49a81bf950f6bef9c653b1de6acb0047
Instruction Fuzzy Hash: 7E31807190122DBFDB209B51DC88EFFBB7CEF05794F200166F905F6240D6309A4ADAA1

Function 00EC3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00EC3D40
_wcslen.LIBCMT ref: 00EC3D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00EC3D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00EC3DBE
RemoveDirectoryW.KERNEL32(?), ref: 00EC3DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00EC3E55
CloseHandle.KERNEL32(00000000), ref: 00EC3E60
CloseHandle.KERNEL32(00000000), ref: 00EC3E6B

Strings

\??\%s, xrefs: 00EC3D5B
\, xrefs: 00EC3D77
:, xrefs: 00EC3D82

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 2b9724ac1051b4995a321a35becd07a4290ed504c0eb02e70d1a4158760c8555
Instruction ID: 1ec0442e331f0d1e65a58159320869249d859470a94291de6a04f2805c29640f
Opcode Fuzzy Hash: 2b9724ac1051b4995a321a35becd07a4290ed504c0eb02e70d1a4158760c8555
Instruction Fuzzy Hash: B631A571900249ABDB209BA1DC89FEF3BBDEF88705F1091A9F609E6160E77197458B24

Function 00EBE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00EBE6B4

Part of subcall function 00E6E551: timeGetTime.WINMM(?,?,00EBE6D4), ref: 00E6E555

Sleep.KERNEL32(0000000A), ref: 00EBE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00EBE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00EBE727
SetActiveWindow.USER32 ref: 00EBE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00EBE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00EBE773
Sleep.KERNEL32(000000FA), ref: 00EBE77E
IsWindow.USER32 ref: 00EBE78A
EndDialog.USER32(00000000), ref: 00EBE79B

Strings

BUTTON, xrefs: 00EBE719

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: b76f9bdf5214951f1790ac98067c59f553f0be08c48f9b07f8967fd980808d94
Instruction ID: 08e6c14f74861cace9fd84c74d303c060698fb71b112647c650143138a1d0b26
Opcode Fuzzy Hash: b76f9bdf5214951f1790ac98067c59f553f0be08c48f9b07f8967fd980808d94
Instruction Fuzzy Hash: C921C67120024DBFEB205F71ECC9AA73F69FB54748F202425F905B53A1DF71AC0AAA55

Function 00EBE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00EBEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00EBEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00EBEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00EBEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00EBEAA7

Strings

play PlayMe wait, xrefs: 00EBEA91
status PlayMe mode, xrefs: 00EBEA58
play PlayMe, xrefs: 00EBEAA2
open , xrefs: 00EBEA0C
close PlayMe, xrefs: 00EBEA6E, 00EBEA9B
alias PlayMe, xrefs: 00EBEA36

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: be1fc09ce417fe667392a454538fc35c635ef46d36dade58133be609b09f0233
Instruction ID: efc3c5238ffa379831ef9710a91be76074e1aee9ae0c16957d8993a74a913181
Opcode Fuzzy Hash: be1fc09ce417fe667392a454538fc35c635ef46d36dade58133be609b09f0233
Instruction Fuzzy Hash: 96117331A502597AD720A7A1DC4ADFF6ABCEFD1B44F402829B811F20D1EE705989C5B1

Function 00EB9F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00EBA012
SetKeyboardState.USER32(?), ref: 00EBA07D
GetAsyncKeyState.USER32(000000A0), ref: 00EBA09D
GetKeyState.USER32(000000A0), ref: 00EBA0B4
GetAsyncKeyState.USER32(000000A1), ref: 00EBA0E3
GetKeyState.USER32(000000A1), ref: 00EBA0F4
GetAsyncKeyState.USER32(00000011), ref: 00EBA120
GetKeyState.USER32(00000011), ref: 00EBA12E
GetAsyncKeyState.USER32(00000012), ref: 00EBA157
GetKeyState.USER32(00000012), ref: 00EBA165
GetAsyncKeyState.USER32(0000005B), ref: 00EBA18E
GetKeyState.USER32(0000005B), ref: 00EBA19C

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 10a3215a07a6d878ad0440ad816e09c936b42091dbdc3fc971b5966573d95a2b
Instruction ID: 55b3ceb6fbc202bf1e95c7014a5f2c046489cc109d1b058db572e8af2a2723a4
Opcode Fuzzy Hash: 10a3215a07a6d878ad0440ad816e09c936b42091dbdc3fc971b5966573d95a2b
Instruction Fuzzy Hash: CC51E560A0478829FF35EB6488517FBAFF49F12384F0C95A9D5C27B1C3DA54AA4CC762

Function 00EB5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00EB5CE2
GetWindowRect.USER32(00000000,?), ref: 00EB5CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00EB5D59
GetDlgItem.USER32(?,00000002), ref: 00EB5D69
GetWindowRect.USER32(00000000,?), ref: 00EB5D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00EB5DCF
GetDlgItem.USER32(?,000003E9), ref: 00EB5DDD
GetWindowRect.USER32(00000000,?), ref: 00EB5DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00EB5E31
GetDlgItem.USER32(?,000003EA), ref: 00EB5E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00EB5E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00EB5E67

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 4c81ae218f382a0db7c0297ed3a6fe497b57495547e5cb25be5016288f51b684
Instruction ID: 8a1d1bbf4bb135c4c54603256cbbd191f278efd3bb2a257869efbf07d9db4ee1
Opcode Fuzzy Hash: 4c81ae218f382a0db7c0297ed3a6fe497b57495547e5cb25be5016288f51b684
Instruction Fuzzy Hash: 36512F71A00609AFDF18CF69DD89AAF7BB5FB48700F249229F915F6290D7709E05CB50

Function 00E68BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00E68F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00E68BE8,?,00000000,?,?,?,?,00E68BBA,00000000,?), ref: 00E68FC5

DestroyWindow.USER32(?), ref: 00E68C81
KillTimer.USER32(00000000,?,?,?,?,00E68BBA,00000000,?), ref: 00E68D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00EA6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00E68BBA,00000000,?), ref: 00EA69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00E68BBA,00000000,?), ref: 00EA69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00E68BBA,00000000), ref: 00EA69D4
DeleteObject.GDI32(00000000), ref: 00EA69E6

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 24d45e954c54fdd81f720ca19d0c2769a60069e0fd8017d8c18c34cc1789ddd0
Instruction ID: 20d4288018f8d0f6b9ee2be0f290709060426382302af6b5a81fe1883341df06
Opcode Fuzzy Hash: 24d45e954c54fdd81f720ca19d0c2769a60069e0fd8017d8c18c34cc1789ddd0
Instruction Fuzzy Hash: 3A61ED30101708CFDB318F24EA58B26B7F1FB5635AF146619E042BA560CB31ACD6DF56

Function 00E69838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00E69944: GetWindowLongW.USER32(?,000000EB), ref: 00E69952

GetSysColor.USER32(0000000F), ref: 00E69862

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 43fc04086073e82e3da3e303665afca9ff00bf5a1c609991acea1d674f756a7e
Instruction ID: c1f49dae884290f45edc1c3a6b68a97763973f22be958025e3b4aa977e9b0453
Opcode Fuzzy Hash: 43fc04086073e82e3da3e303665afca9ff00bf5a1c609991acea1d674f756a7e
Instruction Fuzzy Hash: 4441D4311406449FDB249F39AC84BB93BA9FB463B4F245609F9B2AB1E2C7309C46DB10

Function 00E88D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

., xrefs: 00E8903A, 00E88FD0, 00E88FF2

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-3963672497
Opcode ID: 9ac03909dcf56818a5982b84195fc62960b7df68b42be8c405d45a171bd272ad
Instruction ID: a091f4d2d7aefc169949543678555f37adb21bbecbc87324b36fa9d6ea4bd092
Opcode Fuzzy Hash: 9ac03909dcf56818a5982b84195fc62960b7df68b42be8c405d45a171bd272ad
Instruction Fuzzy Hash: 88C1C175E04249AFDB21EFA8C941BADBBF0AF49314F185199F91CB7293CB309941CB61

Function 00EB96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00E9F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00EB9717
LoadStringW.USER32(00000000,?,00E9F7F8,00000001), ref: 00EB9720

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00E9F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00EB9742
LoadStringW.USER32(00000000,?,00E9F7F8,00000001), ref: 00EB9745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00EB9866

Strings

Line %d:, xrefs: 00EB97A0
^ ERROR, xrefs: 00EB97FB
%s (%d) : ==> %s: %s %s, xrefs: 00EB984A
Error: , xrefs: 00EB981D
Line %d (File "%s"):, xrefs: 00EB978F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 4da780e3728a1c7b3c1aa67174f8735d477439c86e89dd182bd044a6a9615d81
Instruction ID: 83145753e48037bcee8b04ca372790a55e985c2cf34a29e0318e2508c52b4c2d
Opcode Fuzzy Hash: 4da780e3728a1c7b3c1aa67174f8735d477439c86e89dd182bd044a6a9615d81
Instruction Fuzzy Hash: A1414F7280021DAACF04EBE0DD86DEEB7B9AF54341F601865FA0572092EB356F4DCB61

Function 00EB06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00E56B57: _wcslen.LIBCMT ref: 00E56B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00EB07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00EB07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00EB07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00EB0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00EB082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00EB0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00EB083C

Strings

\IPC$, xrefs: 00EB0784
SOFTWARE\Classes\, xrefs: 00EB070E
\CLSID, xrefs: 00EB0724

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 8dfcb0db562327427d8f64604c436c7d3da7f54ca83e9d3b4d7d1edadaa20ab0
Instruction ID: 3a911eae925276c64fa331e1ad53c021f1c5ca15bd2b99d46c97499618da7949
Opcode Fuzzy Hash: 8dfcb0db562327427d8f64604c436c7d3da7f54ca83e9d3b4d7d1edadaa20ab0
Instruction Fuzzy Hash: C7411572C1022DAFCF15EBA4DC958EEB7B8BF44350B545529F911B7161EB30AE08CBA0

Function 00EE3F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00EE403B
CreateCompatibleDC.GDI32(00000000), ref: 00EE4042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00EE4055
SelectObject.GDI32(00000000,00000000), ref: 00EE405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00EE4068
DeleteDC.GDI32(00000000), ref: 00EE4072
GetWindowLongW.USER32(?,000000EC), ref: 00EE407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00EE4092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00EE409E

Strings

static, xrefs: 00EE3FD3

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: e1e007042b6f7ca8229cf0b192e123df8470279cb68131f28d07dd170e4eb6c7
Instruction ID: 4b4557180506e84815e85400e4e990a6997be29c3e4c7dac0a16df2fa4811811
Opcode Fuzzy Hash: e1e007042b6f7ca8229cf0b192e123df8470279cb68131f28d07dd170e4eb6c7
Instruction Fuzzy Hash: 8A318B72101299AFDF229FA6CC49FDA3BA9FF0D324F101220FA18B61A0C731D815DB50

Function 00ED3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00ED3C5C
CoInitialize.OLE32(00000000), ref: 00ED3C8A
CoUninitialize.OLE32 ref: 00ED3C94
_wcslen.LIBCMT ref: 00ED3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00ED3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00ED3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00ED3F0E
CoGetObject.OLE32(?,00000000,00EEFB98,?), ref: 00ED3F2D
SetErrorMode.KERNEL32(00000000), ref: 00ED3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00ED3FC4
VariantClear.OLEAUT32(?), ref: 00ED3FD8

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 4e028b4c2a27473e0c3879bb6b352d57c9cc65077ff6afba1d7f10a1622c27bb
Instruction ID: f9bdfd913dda1978bee97ca6afe968aeec869d53fcb8221960875fcb53f99b7d
Opcode Fuzzy Hash: 4e028b4c2a27473e0c3879bb6b352d57c9cc65077ff6afba1d7f10a1622c27bb
Instruction Fuzzy Hash: 6BC133716083059FC700DF68C88496BBBE9FF89748F10591EF88AAB251D731EE06CB52

Function 00EC7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00EC7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00EC7B8F
SHGetDesktopFolder.SHELL32(?), ref: 00EC7BA3
CoCreateInstance.OLE32(00EEFD08,00000000,00000001,00F16E6C,?), ref: 00EC7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00EC7C74
CoTaskMemFree.OLE32(?,?), ref: 00EC7CCC
SHBrowseForFolderW.SHELL32(?), ref: 00EC7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00EC7D7A
CoTaskMemFree.OLE32(00000000), ref: 00EC7D81
CoTaskMemFree.OLE32(00000000), ref: 00EC7DD6
CoUninitialize.OLE32 ref: 00EC7DDC

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 7bcd14c3e7911cf44ca3bfefce02dda8ccd4cd63c2d88be1e7132d7da0f4e0fa
Instruction ID: 9a4ffd520504427b562cfc67d4c7395e18366ca99eba04b3da92d9c7c95d67e5
Opcode Fuzzy Hash: 7bcd14c3e7911cf44ca3bfefce02dda8ccd4cd63c2d88be1e7132d7da0f4e0fa
Instruction Fuzzy Hash: D9C12A75A04109AFCB14DFA4C984DAEBBF9FF48304B149498F85AAB261D731ED46CF90

Function 00EE541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00EE5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00EE5515
CharNextW.USER32(00000158), ref: 00EE5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00EE5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00EE559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00EE55AC

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: a039307981a64f2da405b56e7728c23e737f40d024370178557b288dd4f7b450
Instruction ID: eef8404662767b4fcab064e642bf055949e68a290417f5ceda099b90470b2d0e
Opcode Fuzzy Hash: a039307981a64f2da405b56e7728c23e737f40d024370178557b288dd4f7b450
Instruction Fuzzy Hash: E9619E3290068DEFDF208F96CC84AFE7BB9EB05728F105145F925BB291D7708A85DB61

Function 00EAFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00EAFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00EAFB08
VariantInit.OLEAUT32(?), ref: 00EAFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00EAFB3A
VariantCopy.OLEAUT32(?,?), ref: 00EAFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00EAFBA1
VariantClear.OLEAUT32(?), ref: 00EAFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00EAFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00EAFBCC
VariantClear.OLEAUT32(?), ref: 00EAFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00EAFBE9

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 3ff0f67f010d04785c00bff459d951f92b5c95560439980fa6f06547d044716c
Instruction ID: a97e5090afedb754c25f23f27dd2be8b1c7202dda5dcefd90c4fca3c9a4829d4
Opcode Fuzzy Hash: 3ff0f67f010d04785c00bff459d951f92b5c95560439980fa6f06547d044716c
Instruction Fuzzy Hash: FB415135A002199FCB04DFA5D8A4DEDBBB9FF09344F109069F955BB261C730A946CBA0

Function 00EB9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00EB9CA1
GetAsyncKeyState.USER32(000000A0), ref: 00EB9D22
GetKeyState.USER32(000000A0), ref: 00EB9D3D
GetAsyncKeyState.USER32(000000A1), ref: 00EB9D57
GetKeyState.USER32(000000A1), ref: 00EB9D6C
GetAsyncKeyState.USER32(00000011), ref: 00EB9D84
GetKeyState.USER32(00000011), ref: 00EB9D96
GetAsyncKeyState.USER32(00000012), ref: 00EB9DAE
GetKeyState.USER32(00000012), ref: 00EB9DC0
GetAsyncKeyState.USER32(0000005B), ref: 00EB9DD8
GetKeyState.USER32(0000005B), ref: 00EB9DEA

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 5eaba42894610fdc58a83b808489fe9f6427c1ec61c24ade68936fa3d36795a6
Instruction ID: d211a47ecd0037208e4229f9fb8d6fc3841091ed18de77db4b23c0b16c65ce31
Opcode Fuzzy Hash: 5eaba42894610fdc58a83b808489fe9f6427c1ec61c24ade68936fa3d36795a6
Instruction Fuzzy Hash: BB41A5345047CA6DFF31966188443E7FEE06F11348F48905ADBC67A5C3DBA5A9C8CBA2

Function 00ED055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00ED05BC
inet_addr.WSOCK32(?), ref: 00ED061C
gethostbyname.WSOCK32(?), ref: 00ED0628
IcmpCreateFile.IPHLPAPI ref: 00ED0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00ED06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00ED06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00ED07B9
WSACleanup.WSOCK32 ref: 00ED07BF

Strings

Ping, xrefs: 00ED0676

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: b71ecde1ad2ec5e8b0238015fdf4b26a0cb58bebc7adfc7afee69c6d89eb3e7d
Instruction ID: 482a5b8d007c1ac83125c4442d7e08301e7aa2d95ace5af6112bf0af532d5387
Opcode Fuzzy Hash: b71ecde1ad2ec5e8b0238015fdf4b26a0cb58bebc7adfc7afee69c6d89eb3e7d
Instruction Fuzzy Hash: F9916C356042419FD320DF25D488B1ABBE0EF44318F1895AAF869AF7A2C770ED46CF91

Function 00ED8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00ED8CF3

Part of subcall function 00EB8E54: _wcslen.LIBCMT ref: 00EB8E77

_wcslen.LIBCMT ref: 00ED8D4E
_wcslen.LIBCMT ref: 00ED8D9C
_wcslen.LIBCMT ref: 00ED8DDC
_wcslen.LIBCMT ref: 00ED8E6E

Strings

none, xrefs: 00ED8E65, 00ED8E6A
cdecl, xrefs: 00ED8D48, 00ED8D4D
stdcall, xrefs: 00ED8DD6, 00ED8DDB
winapi, xrefs: 00ED8D96, 00ED8D9B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: ce4ee0c847f277cccbdef4f8d977dae098d5bc53385b0f6ab1a253c3f1667a1a
Instruction ID: 281f0e0933fc6d2b8cdc1927a7f37d1bf362499a8bb58e2d95255f73d9b275a1
Opcode Fuzzy Hash: ce4ee0c847f277cccbdef4f8d977dae098d5bc53385b0f6ab1a253c3f1667a1a
Instruction Fuzzy Hash: 2B519131A001169BCB14DF68CE509BEB7E6EF64714B20662AE826F73C5DB31DD42CB90

Function 00ED372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00ED3774
CoUninitialize.OLE32 ref: 00ED377F
CoCreateInstance.OLE32(?,00000000,00000017,00EEFB78,?), ref: 00ED37D9
IIDFromString.OLE32(?,?), ref: 00ED384C
VariantInit.OLEAUT32(?), ref: 00ED38E4
VariantClear.OLEAUT32(?), ref: 00ED3936

Strings

Failed to create object, xrefs: 00ED37E4, 00ED389A
NULL Pointer assignment, xrefs: 00ED381E
Invalid parameter, xrefs: 00ED3865

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 2e466d5afd68741bf730cfa211cf3e268078b0cfbae4ff65a4c724a0eab39452
Instruction ID: 2882f6e7692affa68bc68ff4754608921f19a8fe72acbf61b437facccc5c7f07
Opcode Fuzzy Hash: 2e466d5afd68741bf730cfa211cf3e268078b0cfbae4ff65a4c724a0eab39452
Instruction Fuzzy Hash: CB61AE74608701AFD314DF64D889B9ABBE4EF48714F10180AF885AB391D770EE4ADB93

Function 00EC3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00EC33CF

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00EC33F0

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00EC3504
^ ERROR , xrefs: 00EC349E
"%s" (%d) : ==> %s:, xrefs: 00EC3522
Incorrect parameters to object property !, xrefs: 00EC34AB
Error: , xrefs: 00EC34D1
Line %d (File "%s"):, xrefs: 00EC3443, 00EC345C

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 3c88761040de2bafa0e752c6c9615de9ff94a5446223242a0891436adb74d189
Instruction ID: 50d8b5a36d13c9171df064976eeb5214e83cd1dba54eea82bbf735e689296b06
Opcode Fuzzy Hash: 3c88761040de2bafa0e752c6c9615de9ff94a5446223242a0891436adb74d189
Instruction Fuzzy Hash: 0051B13290020DAADF14EBA0CE42EEEB3B9EF14341F205465F90573062EB356F59DB61

Function 00EBB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00EBB5FC
_wcslen.LIBCMT ref: 00EBB608
_wcslen.LIBCMT ref: 00EBB64D
_wcslen.LIBCMT ref: 00EBB68C
_wcslen.LIBCMT ref: 00EBB6C7

Strings

APPEND, xrefs: 00EBB6C1, 00EBB6C6
REMOVE, xrefs: 00EBB602, 00EBB607
EXISTS, xrefs: 00EBB686, 00EBB68B
KEYS, xrefs: 00EBB647, 00EBB64C

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: e3cd9241d2f3039d07ec0748c400258672b2d5f36332e2b19007839c15eb77e2
Instruction ID: e68a6823209452de98713362724f903a7fc5eb5f63bf4580d49cab2aa7b9bf18
Opcode Fuzzy Hash: e3cd9241d2f3039d07ec0748c400258672b2d5f36332e2b19007839c15eb77e2
Instruction Fuzzy Hash: B441EB32A000279BCB205F7DCD905FF77A5AFA0758B24522AE565FB288EB71CD81C790

Function 00EC5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00EC53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00EC5416
GetLastError.KERNEL32 ref: 00EC5420
SetErrorMode.KERNEL32(00000000,READY), ref: 00EC54A7

Strings

INVALID, xrefs: 00EC5459
NOTREADY, xrefs: 00EC544B
READONLY, xrefs: 00EC5452
UNKNOWN, xrefs: 00EC5444
READY, xrefs: 00EC5460, 00EC5468

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 07ca4a0f1ed5b79996f74e8560841383d150cc7baa00688da4feb756410c42e4
Instruction ID: 9fb6785f58e794bb567522d38d781a4059672d3be9ebfb341d65f07e29cf789e
Opcode Fuzzy Hash: 07ca4a0f1ed5b79996f74e8560841383d150cc7baa00688da4feb756410c42e4
Instruction Fuzzy Hash: 4A318C36A005049FC714DF68C984FEABBB4FB44309F149459E812EB292DA32EDC7CB90

Function 00EE3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00EE3C79
SetMenu.USER32(?,00000000), ref: 00EE3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00EE3D10
IsMenu.USER32(?), ref: 00EE3D24
CreatePopupMenu.USER32 ref: 00EE3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00EE3D5B
DrawMenuBar.USER32 ref: 00EE3D63

Strings

0, xrefs: 00EE3C54
F, xrefs: 00EE3D4E

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: a65bfc3ff40028383901513191289f51220fc08deb061afbafd2ccc2f56ee28d
Instruction ID: 3ae001ec1fd96fe9f0fe6be116ecb3b8a7a9d871d3abc277aa003f26665b9364
Opcode Fuzzy Hash: a65bfc3ff40028383901513191289f51220fc08deb061afbafd2ccc2f56ee28d
Instruction Fuzzy Hash: 8B418974A01249EFDB24CF66D888AEA7BB5FF49304F140028F906AB360D730AA15CF94

Function 00EB1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

Part of subcall function 00EB3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EB3CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00EB1F64
GetDlgCtrlID.USER32 ref: 00EB1F6F
GetParent.USER32 ref: 00EB1F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00EB1F8E
GetDlgCtrlID.USER32(?), ref: 00EB1F97
GetParent.USER32(?), ref: 00EB1FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00EB1FAE

Strings

ListBox, xrefs: 00EB1F21
ComboBox, xrefs: 00EB1EEC

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: c27a4148c2c2edaba02febfcebd4aa9c552e78eb91f5de899154f07a20eb1feb
Instruction ID: 295cf29bfed9880ff09e768c9a89da8dc0e0d659bcfbe55889073eb8199715ed
Opcode Fuzzy Hash: c27a4148c2c2edaba02febfcebd4aa9c552e78eb91f5de899154f07a20eb1feb
Instruction Fuzzy Hash: C721B074A00218BFCF04AFA0CC959FFBBB9EF05310B601555B96177292CB355909DB61

Function 00EB1FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

Part of subcall function 00EB3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EB3CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00EB2043
GetDlgCtrlID.USER32 ref: 00EB204E
GetParent.USER32 ref: 00EB206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00EB206D
GetDlgCtrlID.USER32(?), ref: 00EB2076
GetParent.USER32(?), ref: 00EB208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00EB208D

Strings

ListBox, xrefs: 00EB2002
ComboBox, xrefs: 00EB1FCD

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 4b1f696e9ec40ca15a479ecc51735b9a5290649d263f355f28263995f3f29d1e
Instruction ID: 19663b0f34950190feec2ff2a3f7566a97b8f59a096c6d28464b749f3d816fd8
Opcode Fuzzy Hash: 4b1f696e9ec40ca15a479ecc51735b9a5290649d263f355f28263995f3f29d1e
Instruction Fuzzy Hash: 0A21D175900218BFCF14AFA4CC85EEFBBB8EF09300F205409B951B71A2CA798919DB61

Function 00EE3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00EE3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00EE3AA0
GetWindowLongW.USER32(?,000000F0), ref: 00EE3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00EE3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00EE3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00EE3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00EE3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00EE3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00EE3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00EE3C13

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: af5d20336b912cc1e2fb3b54a7ecc2e5932519e661b7972b7de69157c1eb7038
Instruction ID: c71837ff49c45bf3adc9e9b55c5e02f474b27f84abc9083d4d48420973fd01e1
Opcode Fuzzy Hash: af5d20336b912cc1e2fb3b54a7ecc2e5932519e661b7972b7de69157c1eb7038
Instruction Fuzzy Hash: 43616C75900248AFDB20DF68CC85EEE77F8EB09704F104199FA15B72A1D770AE85DB60

Function 00EBB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00EBB151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00EBA1E1,?,00000001), ref: 00EBB165
GetWindowThreadProcessId.USER32(00000000), ref: 00EBB16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00EBA1E1,?,00000001), ref: 00EBB17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00EBB18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00EBA1E1,?,00000001), ref: 00EBB1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00EBA1E1,?,00000001), ref: 00EBB1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00EBA1E1,?,00000001), ref: 00EBB1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00EBA1E1,?,00000001), ref: 00EBB212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00EBA1E1,?,00000001), ref: 00EBB21D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: cc0ebf2b40bb9391a3741b38af94104e83e5cf37ac8839201535bad330f6af60
Instruction ID: 719e98322c4b6289dec94da088558a54c722c58a2d8a44c54ed3392172f6447d
Opcode Fuzzy Hash: cc0ebf2b40bb9391a3741b38af94104e83e5cf37ac8839201535bad330f6af60
Instruction Fuzzy Hash: 183181B1600208BFDB20DF25DC84FAF7BA9BB51719F205015F911EA1A0D7B89D468F70

Function 00E82C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E82C94

Part of subcall function 00E829C8: HeapFree.KERNEL32(00000000,00000000,?,00E8D7D1,00000000,00000000,00000000,00000000,?,00E8D7F8,00000000,00000007,00000000,?,00E8DBF5,00000000), ref: 00E829DE
Part of subcall function 00E829C8: GetLastError.KERNEL32(00000000,?,00E8D7D1,00000000,00000000,00000000,00000000,?,00E8D7F8,00000000,00000007,00000000,?,00E8DBF5,00000000,00000000), ref: 00E829F0

_free.LIBCMT ref: 00E82CA0
_free.LIBCMT ref: 00E82CAB
_free.LIBCMT ref: 00E82CB6
_free.LIBCMT ref: 00E82CC1
_free.LIBCMT ref: 00E82CCC
_free.LIBCMT ref: 00E82CD7
_free.LIBCMT ref: 00E82CE2
_free.LIBCMT ref: 00E82CED
_free.LIBCMT ref: 00E82CFB

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dc4bc405b0b70e346320061c7093c108f1531200b302fe9d3c16abacd2d2b3a6
Instruction ID: f1ef401910651190eee63d9ad82f5402ffa4d26e8e755c267ca27439dcb7693b
Opcode Fuzzy Hash: dc4bc405b0b70e346320061c7093c108f1531200b302fe9d3c16abacd2d2b3a6
Instruction Fuzzy Hash: 6611A476500108AFCB02FF54D982CDD3BA5FF45350F4254A9FA4CAF222DA35EE509B90

Function 00E51410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00E51459
OleUninitialize.OLE32(?,00000000), ref: 00E514F8
UnregisterHotKey.USER32(?), ref: 00E516DD
DestroyWindow.USER32(?), ref: 00E924B9
FreeLibrary.KERNEL32(?), ref: 00E9251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00E9254B

Strings

close all, xrefs: 00E51454

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: f715d4cf50b40fe48cbf44b7ce5cd098a2658b483f81ba4dfb6512f2dbd5dc1d
Instruction ID: 61ae52b3d1ff20f30246386695f9558ae998c0af1927fb9c57a3329c3102c7ae
Opcode Fuzzy Hash: f715d4cf50b40fe48cbf44b7ce5cd098a2658b483f81ba4dfb6512f2dbd5dc1d
Instruction Fuzzy Hash: C8D188306012129FCF29EF15D899B68F7A0BF04305F2565ADE94A7B262CB31AC1ACF51

Function 00EC7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00EC7FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00EC7FC1
GetFileAttributesW.KERNEL32(?), ref: 00EC7FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00EC8005
SetCurrentDirectoryW.KERNEL32(?), ref: 00EC8017
SetCurrentDirectoryW.KERNEL32(?), ref: 00EC8060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00EC80B0

Strings

*.*, xrefs: 00EC8066

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 20216c561165b36c48c74a1bcb95a05f01668c93f2670dd94bc6ea2dfb4a7ac3
Instruction ID: 4fb297fa45eaa96ef48eaeaeaf9d3dbbe2ade99a069976510a634e04518c5b9b
Opcode Fuzzy Hash: 20216c561165b36c48c74a1bcb95a05f01668c93f2670dd94bc6ea2dfb4a7ac3
Instruction Fuzzy Hash: 7981AF725082419FCB20DB14CA41EAAB3E8BB88354F146C5EF8C5E7250EB36DD4ACB52

Function 00E55BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00E55C7A

Part of subcall function 00E55D0A: GetClientRect.USER32(?,?), ref: 00E55D30
Part of subcall function 00E55D0A: GetWindowRect.USER32(?,?), ref: 00E55D71
Part of subcall function 00E55D0A: ScreenToClient.USER32(?,?), ref: 00E55D99

GetDC.USER32 ref: 00E946F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00E94708
SelectObject.GDI32(00000000,00000000), ref: 00E94716
SelectObject.GDI32(00000000,00000000), ref: 00E9472B
ReleaseDC.USER32(?,00000000), ref: 00E94733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00E947C4

Strings

U, xrefs: 00E94693

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 19ed141811c76c5302fd3e3a15e35b72f23292e31e9f3474cb2446cead8cc157
Instruction ID: 4a56b93a8660f890d8938432370819b68f60c0fa6199cba64b9d5bc226c8ca10
Opcode Fuzzy Hash: 19ed141811c76c5302fd3e3a15e35b72f23292e31e9f3474cb2446cead8cc157
Instruction Fuzzy Hash: 9371D0B1400209DFCF218FA4C984EFA7BB5FF4A359F14666AED517A1A6C3309846DF50

Function 00EC359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00EC35E4

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

LoadStringW.USER32(00F22390,?,00000FFF,?), ref: 00EC360A

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00EC3724
"%s" (%d) : ==> %s:, xrefs: 00EC3742
^ ERROR, xrefs: 00EC36C9
Error: , xrefs: 00EC36EF
Line %d (File "%s"):, xrefs: 00EC366B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 07e2d54f3ed8f8e9c9bd25dc8a1b9a567f1702d77624f578df39cd931d01b88c
Instruction ID: ebf94aeedafae5b37c273ffd1ede2fbd6ded023dc87886f5cb202baa70f643d5
Opcode Fuzzy Hash: 07e2d54f3ed8f8e9c9bd25dc8a1b9a567f1702d77624f578df39cd931d01b88c
Instruction Fuzzy Hash: 1851917280020DBACF14EBA0CD42EEEBBB5EF14341F146525F505720A2EB315B99DF61

Function 00EE8B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E69BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E69BB2

Part of subcall function 00E6912D: GetCursorPos.USER32(?), ref: 00E69141
Part of subcall function 00E6912D: ScreenToClient.USER32(00000000,?), ref: 00E6915E
Part of subcall function 00E6912D: GetAsyncKeyState.USER32(00000001), ref: 00E69183
Part of subcall function 00E6912D: GetAsyncKeyState.USER32(00000002), ref: 00E6919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00EE8B6B
ImageList_EndDrag.COMCTL32 ref: 00EE8B71
ReleaseCapture.USER32 ref: 00EE8B77
SetWindowTextW.USER32(?,00000000), ref: 00EE8C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00EE8C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00EE8CFF

Strings

@GUI_DROPID, xrefs: 00EE8C51
@GUI_DRAGFILE, xrefs: 00EE8C9A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 609c8ea703f8dbfabb7a7654488dfd1640468574c67e6fef7f10ba5fd1125658
Instruction ID: 95682a74ce38d7ada8bb82f3859c9368628138c2ae3e84c170b9d01092d9bc8a
Opcode Fuzzy Hash: 609c8ea703f8dbfabb7a7654488dfd1640468574c67e6fef7f10ba5fd1125658
Instruction Fuzzy Hash: B251CC70204348AFD714DF11DC96FAAB7E4FB88714F101A2DF956A72E2CB309949CB62

Function 00ECC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00ECC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00ECC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00ECC2CA
GetLastError.KERNEL32 ref: 00ECC322
SetEvent.KERNEL32(?), ref: 00ECC336
InternetCloseHandle.WININET(00000000), ref: 00ECC341

Strings

, xrefs: 00ECC2BB

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 6b43bb60b92ee0188549985cc7023c1fa3f5a736462a9a169bf2f389baca1d1a
Instruction ID: 59b3f0bc8e9e2ca92430aaf3929e5d1596beeaae74d9209bf903e02133990479
Opcode Fuzzy Hash: 6b43bb60b92ee0188549985cc7023c1fa3f5a736462a9a169bf2f389baca1d1a
Instruction Fuzzy Hash: 5831D171500748AFD7219F699E88FAB7BFCEB49744B24941EF44AB6210DB32DC078B60

Function 00EB989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00E93AAF,?,?,Bad directive syntax error,00EECC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00EB98BC
LoadStringW.USER32(00000000,?,00E93AAF,?), ref: 00EB98C3

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00EB9987

Strings

Line %d:, xrefs: 00EB9912
., xrefs: 00EB996D
Error: , xrefs: 00EB9955
Line %d (File "%s"):, xrefs: 00EB992D
%s (%d) : ==> %s.: %s %s, xrefs: 00EB98F1

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: eb4769d1c6c380776f144580d7bddd8ab72be8cb4045ef81bc645c0383822afe
Instruction ID: 4b7086e9a892ad9d3570eede4922e9c7d8a775bcebb3b6b1c2753aa19102927d
Opcode Fuzzy Hash: eb4769d1c6c380776f144580d7bddd8ab72be8cb4045ef81bc645c0383822afe
Instruction Fuzzy Hash: FB217E3190021EEBCF15AFA0CC46EEE77B5FF18341F045865FA15760A2EB719658DB11

Function 00EB209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00EB20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00EB20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00EB214D

Strings

details, xrefs: 00EB20FB
list, xrefs: 00EB212F
largeicons, xrefs: 00EB20E1
smallicons, xrefs: 00EB2115
SHELLDLL_DefView, xrefs: 00EB20CC

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 15cda5aa7ebd6445942e103ed51d066a9a83ff40c1a4c248d64c621139b66448
Instruction ID: 465f6968b9ff312712fae1d64d386010c0336a2d69eab8a7adc8a53590308137
Opcode Fuzzy Hash: 15cda5aa7ebd6445942e103ed51d066a9a83ff40c1a4c248d64c621139b66448
Instruction Fuzzy Hash: 681106B6688707B9F6016224DC06DE7379CCF44B28F20601AFB08F50E2FA65A8426A15

Function 00E8CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00E8CEB7
_free.LIBCMT ref: 00E8CF22
_free.LIBCMT ref: 00E8CF48
_free.LIBCMT ref: 00E8CF71
_free.LIBCMT ref: 00E8CFA9
_free.LIBCMT ref: 00E8CFDA
_free.LIBCMT ref: 00E8D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00E8D09C
_free.LIBCMT ref: 00E8D0B5

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 1e15a76243102810249fb3808aa973fbaa6f620f2e1408dbe00a4ad100348d7d
Instruction ID: 127c67198c4d9fd5472d5dc7879912b257b6c9944257c5a2b98f392b9d47d894
Opcode Fuzzy Hash: 1e15a76243102810249fb3808aa973fbaa6f620f2e1408dbe00a4ad100348d7d
Instruction Fuzzy Hash: A5615B72A05304AFEF31BFB49C81A697BD5EF06314F24516EFA4CB7282DA319D028760

Function 00E68B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00EA6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00EA68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00EA68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00EA68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00EA68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00E68874,00000000,00000000,00000000,000000FF,00000000), ref: 00EA6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00EA691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00E68874,00000000,00000000,00000000,000000FF,00000000), ref: 00EA692D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: eb244a8b57c52f812c370b1212d311b22e0ad5875278a495895aa83e364067de
Instruction ID: cde94ae4c932a97154abd86b9007be35fa63d97b4cc70af7d6bb64081a163558
Opcode Fuzzy Hash: eb244a8b57c52f812c370b1212d311b22e0ad5875278a495895aa83e364067de
Instruction Fuzzy Hash: 5B51BAB4600209EFDB20CF25DC95FAA3BB5FB59794F141618F912AB2A0DB70E981DB40

Function 00ECC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00ECC182
GetLastError.KERNEL32 ref: 00ECC195
SetEvent.KERNEL32(?), ref: 00ECC1A9

Part of subcall function 00ECC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00ECC272
Part of subcall function 00ECC253: GetLastError.KERNEL32 ref: 00ECC322
Part of subcall function 00ECC253: SetEvent.KERNEL32(?), ref: 00ECC336
Part of subcall function 00ECC253: InternetCloseHandle.WININET(00000000), ref: 00ECC341

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 1b82a469cfe521558adf37a89db4afc471a5cd4a16d818de0fb56a342587d313
Instruction ID: 0af9d80452e9f9c2273bcc336e0df996013a1a23414ac6808e58628b6b82895a
Opcode Fuzzy Hash: 1b82a469cfe521558adf37a89db4afc471a5cd4a16d818de0fb56a342587d313
Instruction Fuzzy Hash: 5831C371500A44EFDB248FB6DE44F66BBF8FF18304B24541DF95AA6620D732E8169B60

Function 00EB25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EB3A57
Part of subcall function 00EB3A3D: GetCurrentThreadId.KERNEL32 ref: 00EB3A5E
Part of subcall function 00EB3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00EB25B3), ref: 00EB3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00EB25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00EB25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00EB25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00EB25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00EB2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00EB2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00EB260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00EB2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00EB2627

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 9c61171d2bed6455133e3c8241acec8e2970284b09962a10c6f1e967da4860ab
Instruction ID: 6aa9a9dddfb43dd0b86682e85007c4d0fceaf9924e112d21fde1c21650d555ef
Opcode Fuzzy Hash: 9c61171d2bed6455133e3c8241acec8e2970284b09962a10c6f1e967da4860ab
Instruction Fuzzy Hash: A001D830390254BBFB1067699CCAF9A7FA9DF4EB12F201015F354BE0D1C9E114498A6A

Function 00EB1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00EB1449,?,?,00000000), ref: 00EB180C
HeapAlloc.KERNEL32(00000000,?,00EB1449,?,?,00000000), ref: 00EB1813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00EB1449,?,?,00000000), ref: 00EB1828
GetCurrentProcess.KERNEL32(?,00000000,?,00EB1449,?,?,00000000), ref: 00EB1830
DuplicateHandle.KERNEL32(00000000,?,00EB1449,?,?,00000000), ref: 00EB1833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00EB1449,?,?,00000000), ref: 00EB1843
GetCurrentProcess.KERNEL32(00EB1449,00000000,?,00EB1449,?,?,00000000), ref: 00EB184B
DuplicateHandle.KERNEL32(00000000,?,00EB1449,?,?,00000000), ref: 00EB184E
CreateThread.KERNEL32(00000000,00000000,00EB1874,00000000,00000000,00000000), ref: 00EB1868

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 94fad3c5907584200ca578d15acc1d179a2af40fadd5b135dba12aef40488798
Instruction ID: 20d0ed72d3f13dbdb1d23dfd56a90c653a4b44eb6b1ec6b9c86a0f8dc15eeffb
Opcode Fuzzy Hash: 94fad3c5907584200ca578d15acc1d179a2af40fadd5b135dba12aef40488798
Instruction Fuzzy Hash: 9801BF75241348BFE710AB65DC8DF573B6CEB89B11F504451FA05EF192C6709805CB20

Function 00E83E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00E83F0B
__alldvrm.LIBCMT ref: 00E8410C
__alldvrm.LIBCMT ref: 00E8412E

Strings

}}, xrefs: 00E83E8A
}}, xrefs: 00E83E96, 00E83EF1, 00E83F0A, 00E84090
}}, xrefs: 00E840CD

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}$}}$}}
API String ID: 1036877536-1495402609
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 083004918d73929147989055dc49d7e12774d17be860156de592089078b578e1
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 31A159B1E003879FDB15EF28C8917AEBBE5EF61354F1451ADE68DBB282C2348941C791

Function 00EDA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00EBD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00EBD501
Part of subcall function 00EBD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00EBD50F
Part of subcall function 00EBD4DC: CloseHandle.KERNEL32(00000000), ref: 00EBD5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00EDA16D
GetLastError.KERNEL32 ref: 00EDA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00EDA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00EDA268
GetLastError.KERNEL32(00000000), ref: 00EDA273
CloseHandle.KERNEL32(00000000), ref: 00EDA2C4

Strings

SeDebugPrivilege, xrefs: 00EDA18F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: ec6f6ab876f01f045fce2669fee5bdc37960efb6e7363b916b215e4380a316f2
Instruction ID: b6724b3ace7900ed99ce86b7b7fe8cebb111198703f304029b0578296bac69e2
Opcode Fuzzy Hash: ec6f6ab876f01f045fce2669fee5bdc37960efb6e7363b916b215e4380a316f2
Instruction Fuzzy Hash: B661AF702092429FD710DF15C894F16BBE1EF44318F18949DE4666B7A3C772ED4ACB92

Function 00EE3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00EE3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00EE393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00EE3954
_wcslen.LIBCMT ref: 00EE3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00EE39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00EE39F4

Strings

SysListView32, xrefs: 00EE38F7

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 3cfeeeae9f0b2571037a5c19da99853fa462681008ccc553d0fcd99d1e38f218
Instruction ID: 1df4078efbbdae57e0fe5df681ede744af75c79d7e5ad1a30709c7d140323708
Opcode Fuzzy Hash: 3cfeeeae9f0b2571037a5c19da99853fa462681008ccc553d0fcd99d1e38f218
Instruction Fuzzy Hash: 6241C171A0035DABEF219F65CC49BEA7BA9EF48354F101526F948F7282D371DA84CB90

Function 00EBBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00EBBCFD
IsMenu.USER32(00000000), ref: 00EBBD1D
CreatePopupMenu.USER32 ref: 00EBBD53
GetMenuItemCount.USER32(010E6548), ref: 00EBBDA4
InsertMenuItemW.USER32(010E6548,?,00000001,00000030), ref: 00EBBDCC

Strings

2, xrefs: 00EBBD37
0, xrefs: 00EBBCA8

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: a55de5c3da7cb256f6f519fd91272329c97a886ba01d2fe9b4ad1e8b7a3222b4
Instruction ID: 6b14ecae847495693e335259a1d0866a98d35afcf7dc681d13c9353134cbcbb7
Opcode Fuzzy Hash: a55de5c3da7cb256f6f519fd91272329c97a886ba01d2fe9b4ad1e8b7a3222b4
Instruction Fuzzy Hash: 60519C70A042099FDF21CFA9D884BEFBBF4AF45318F245219E451FB290D7B89945CB61

Function 00E72D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00E72D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00E72D53
_ValidateLocalCookies.LIBCMT ref: 00E72DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00E72E0C
_ValidateLocalCookies.LIBCMT ref: 00E72E61

Strings

&H, xrefs: 00E72DFE, 00E72E07, 00E72E18
csm, xrefs: 00E72DF6

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &H$csm
API String ID: 1170836740-1242228090
Opcode ID: 9786ac1cb27068d873dcde8f92da623bfb70e83b2e62079ff57075ac046f26fc
Instruction ID: e4c76263dbd152f6906d9fa4e0c52ac6a56596f0136acbd18e228c73a32962dd
Opcode Fuzzy Hash: 9786ac1cb27068d873dcde8f92da623bfb70e83b2e62079ff57075ac046f26fc
Instruction Fuzzy Hash: 0F418234E002099BCF24DF68C855A9EBBA5FF44318F14D159EA18BB292D731EA05CB91

Function 00EBC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00EBC913

Strings

blank, xrefs: 00EBC895
stop, xrefs: 00EBC8E4
question, xrefs: 00EBC8CC
warning, xrefs: 00EBC8FC
info, xrefs: 00EBC8B4

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 0aff07a3b599d8e1f89cc633450d130a3272fb93e455ed68ad91a1678c1450e7
Instruction ID: 1517e1c8c3897fb048d42978c6c277472172796c2ed2efdd856af8d819f59a49
Opcode Fuzzy Hash: 0aff07a3b599d8e1f89cc633450d130a3272fb93e455ed68ad91a1678c1450e7
Instruction Fuzzy Hash: F211E73268D307BAB7059B549C82CEB67DCDF95369B30502AF508F61C2EBA0AE416265

Function 00EBDE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00EBDE42
gethostname.WSOCK32(?,00000100), ref: 00EBDE5C
gethostbyname.WSOCK32(?), ref: 00EBDE69
inet_ntoa.WSOCK32(?), ref: 00EBDEAB
_strcat.LIBCMT ref: 00EBDEB9
WSACleanup.WSOCK32 ref: 00EBDEDE

Strings

0.0.0.0, xrefs: 00EBDE87

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: b81acba674f35d359a83a7047a60e04661383cee70d6bd692002153141d052ae
Instruction ID: dda826da9cee377fe16db60fc54c3f24f1c6d937877d8b663ff187c5f5b42e89
Opcode Fuzzy Hash: b81acba674f35d359a83a7047a60e04661383cee70d6bd692002153141d052ae
Instruction Fuzzy Hash: FD110671908209AFCB24AB31DC4AEEF77BCDF51714F10116AF549BA091FF71DA818A50

Function 00EE9F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E69BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E69BB2

GetSystemMetrics.USER32(0000000F), ref: 00EE9FC7
GetSystemMetrics.USER32(0000000F), ref: 00EE9FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00EEA224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00EEA242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00EEA263
ShowWindow.USER32(00000003,00000000), ref: 00EEA282
InvalidateRect.USER32(?,00000000,00000001), ref: 00EEA2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 00EEA2CA

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 1907ac0d8ed71dd2321ed6297273b1ec7334f54cf4b04bceffd68e0532a43188
Instruction ID: cceea2755f8f7da11e368d611f822c89046664bfd3044a91d0a859453134d6d9
Opcode Fuzzy Hash: 1907ac0d8ed71dd2321ed6297273b1ec7334f54cf4b04bceffd68e0532a43188
Instruction Fuzzy Hash: C2B1B730600259EFDF14CF6AC9847AA7BB2BF48705F089079ED89AB2A5D731A940CB51

Function 00EBED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00EBED2A
_wcslen.LIBCMT ref: 00EBED3B
_wcslen.LIBCMT ref: 00EBED79
_wcslen.LIBCMT ref: 00EBEDAF
_wcslen.LIBCMT ref: 00EBEDDF
_wcslen.LIBCMT ref: 00EBEDEF
_wcslen.LIBCMT ref: 00EBEE2B
_wcslen.LIBCMT ref: 00EBEE5A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: fef1f15ab35d3e96c226f3be700e95802ea00509dd31db48171ee359ced9e7c0
Instruction ID: 10655f1e9e400e59ef0d98257c58fc659a830c770e6c20113532fa1ca248d33b
Opcode Fuzzy Hash: fef1f15ab35d3e96c226f3be700e95802ea00509dd31db48171ee359ced9e7c0
Instruction Fuzzy Hash: 0241BE65C1025876CB11EBB48C8A9CFB7FCAF45300F10A566E618F3262FB34E245C3A6

Function 00E6F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00EA682C,00000004,00000000,00000000), ref: 00E6F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00EA682C,00000004,00000000,00000000), ref: 00EAF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00EA682C,00000004,00000000,00000000), ref: 00EAF454

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: a36e914e64adade528775b510082c9f4cdb220e3bb31ab77b031184988557ccf
Instruction ID: 41174dc67e6730a3da3a95a80f84bacd2bc2813d7d9a2613c85c29efcd39deca
Opcode Fuzzy Hash: a36e914e64adade528775b510082c9f4cdb220e3bb31ab77b031184988557ccf
Instruction Fuzzy Hash: 04412D30544780BEDB388BB9F8C876A7BA1ABDA398F14743DF0977A660C671E485D710

Function 00EE2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00EE2D1B
GetDC.USER32(00000000), ref: 00EE2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00EE2D2E
ReleaseDC.USER32(00000000,00000000), ref: 00EE2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00EE2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00EE2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00EE5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00EE2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00EE2DE1

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 7cb18ed52bc06d01f890da563c72bb6db152da8854558898c0090546b08b04fb
Instruction ID: e2b104d6e3553e33fd4425ec9c8d36dd7f2095681e557e98e826e978091af34c
Opcode Fuzzy Hash: 7cb18ed52bc06d01f890da563c72bb6db152da8854558898c0090546b08b04fb
Instruction Fuzzy Hash: 4A318B72201298BFEB118F558C8AFEB3BADEB49715F144055FF08AE291C6759C42CBA1

Function 00EB5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00EB5637
_memcmp.LIBVCRUNTIME ref: 00EB5659
_memcmp.LIBVCRUNTIME ref: 00EB5671
_memcmp.LIBVCRUNTIME ref: 00EB5684
_memcmp.LIBVCRUNTIME ref: 00EB569E
_memcmp.LIBVCRUNTIME ref: 00EB56B1
_memcmp.LIBVCRUNTIME ref: 00EB56C9
_memcmp.LIBVCRUNTIME ref: 00EB56E4

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 8205e37dc3b46ecc7714a2222793564e49c4c54b81662a67344a6964bc3c4b97
Instruction ID: b2a6cc6d3541fc280105fae3f733dec01f132bf88ac1d80ee371e6102f5ae0b3
Opcode Fuzzy Hash: 8205e37dc3b46ecc7714a2222793564e49c4c54b81662a67344a6964bc3c4b97
Instruction Fuzzy Hash: 4321C973B40B1D77E21455259D82FFB739CAF2038CF646021FD08BA585FB60EE1182A5

Function 00ED4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00ED502E, 00ED5383
Not an Object type, xrefs: 00ED5007

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 18463fff09591e8c94b835b5fc72396ace18b8892549805bec877bd430279b32
Instruction ID: 6e619d2d8588eee83e8bbd87e1ba2a70f5c88a10b6d06d6605d30f0221174d24
Opcode Fuzzy Hash: 18463fff09591e8c94b835b5fc72396ace18b8892549805bec877bd430279b32
Instruction Fuzzy Hash: E6D18F72A0060A9FDB10CF98C881BAEB7B5FF48344F14946AE915BB391E771DD46CB90

Function 00E91522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00E917FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 00E915CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00E917FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00E91651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00E917FB,?,00E917FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00E916E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00E917FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00E916FB

Part of subcall function 00E83820: RtlAllocateHeap.NTDLL(00000000,?,00F21444,?,00E6FDF5,?,?,00E5A976,00000010,00F21440,00E513FC,?,00E513C6,?,00E51129), ref: 00E83852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00E917FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00E91777
__freea.LIBCMT ref: 00E917A2
__freea.LIBCMT ref: 00E917AE

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 92ce8f4c551660158c100e6135d49fcec69adf2625fe10ec5dfdfe9054563d0f
Instruction ID: 5a5fb3fd5f8ff943ebc5f58c735ebc836ec14117acb63a0cd0649bb39b9a6dc3
Opcode Fuzzy Hash: 92ce8f4c551660158c100e6135d49fcec69adf2625fe10ec5dfdfe9054563d0f
Instruction Fuzzy Hash: CF91A072E00217AEDF218EA4C881AEE7BB5AF49714F19669AF905F7181D735DC40CBA0

Function 00ED4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00ED4648
VariantInit.OLEAUT32(?), ref: 00ED4749
VariantClear.OLEAUT32(?), ref: 00ED4753
VariantClear.OLEAUT32(?), ref: 00ED47B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00ED472C
Null Object assignment in FOR..IN loop, xrefs: 00ED45D8, 00ED4706, 00ED47BE

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 7a72d64e48eae01ee9cfb304a36800343db4d4e414b6951cf311cf23eff8e2c2
Instruction ID: b89d5851f79ecaf866ab8ec1ce26296962c9822e92fca701652e8ad83862a77a
Opcode Fuzzy Hash: 7a72d64e48eae01ee9cfb304a36800343db4d4e414b6951cf311cf23eff8e2c2
Instruction Fuzzy Hash: B691A0B0A00219AFCF20CFA5D884FEEBBB8EF55714F10955AF515BB280D7709942CBA0

Function 00EC1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00EC125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00EC1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00EC12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00EC12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00EC135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00EC13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00EC1430

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 7bccce38ef5d32f79a6692e20938506158fd1479fdb4e569fd27508cf39c907d
Instruction ID: a86801ce569e19746c1a2347fc30f82ebd84067831d448a2ce946df51705c1a3
Opcode Fuzzy Hash: 7bccce38ef5d32f79a6692e20938506158fd1479fdb4e569fd27508cf39c907d
Instruction Fuzzy Hash: 0891E1759002089FDB04DF98C884FBEB7B5FF46315F2050A9E950FB2A2D776A942CB50

Function 00E6948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8959e7a60e224c85308655a1802229211583af57ef346a542e6ad81b3711a07c
Instruction ID: 2eb8f798200f898d90f93ac94eb0b6c0776064100e928b925ab7a3aaa35171d1
Opcode Fuzzy Hash: 8959e7a60e224c85308655a1802229211583af57ef346a542e6ad81b3711a07c
Instruction Fuzzy Hash: 69914A71D40219EFCB10CFA9DC84AEEBBB8FF49324F145059E516BB252D774A942CBA0

Function 00ED3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00ED396B
CharUpperBuffW.USER32(?,?), ref: 00ED3A7A
_wcslen.LIBCMT ref: 00ED3A8A
VariantClear.OLEAUT32(?), ref: 00ED3C1F

Part of subcall function 00EC0CDF: VariantInit.OLEAUT32(00000000), ref: 00EC0D1F
Part of subcall function 00EC0CDF: VariantCopy.OLEAUT32(?,?), ref: 00EC0D28
Part of subcall function 00EC0CDF: VariantClear.OLEAUT32(?), ref: 00EC0D34

Strings

AUTOIT.ERROR, xrefs: 00ED3A80, 00ED3A85
Incorrect Parameter format, xrefs: 00ED39A6, 00ED3BA1

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 83532e4470da9c7a29f53111adacdf0f1b8c004f49ccd6643f4938489ab42ce0
Instruction ID: d0231483e5c0d7465ecba75c6e8946a4dd2e395bacc39aa2765ce5df3b9f69fa
Opcode Fuzzy Hash: 83532e4470da9c7a29f53111adacdf0f1b8c004f49ccd6643f4938489ab42ce0
Instruction Fuzzy Hash: 62918D756083059FC704DF24C48096AB7E5FF89314F14992EF889AB352DB31EE4ACB92

Function 00ED4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00EB000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00EAFF41,80070057,?,?,?,00EB035E), ref: 00EB002B
Part of subcall function 00EB000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00EAFF41,80070057,?,?), ref: 00EB0046
Part of subcall function 00EB000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00EAFF41,80070057,?,?), ref: 00EB0054
Part of subcall function 00EB000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00EAFF41,80070057,?), ref: 00EB0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00ED4C51
_wcslen.LIBCMT ref: 00ED4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00ED4DCF
CoTaskMemFree.OLE32(?), ref: 00ED4DDA

Strings

NULL Pointer assignment, xrefs: 00ED4E23, 00ED4E52

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: a3a24a016a5b09c71e75d76d6912a550fcaa9913e525c7311547be18e829d869
Instruction ID: f269545c0bc78f6060cd4041135c101423e411b04e7e011c7d4c1ecff7f72e83
Opcode Fuzzy Hash: a3a24a016a5b09c71e75d76d6912a550fcaa9913e525c7311547be18e829d869
Instruction Fuzzy Hash: C59117B1D0021DAFDF14DFA4C891AEEB7B9FF08304F10556AE915BB281DB309A498F60

Function 00EE20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00EE2183
GetMenuItemCount.USER32(00000000), ref: 00EE21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00EE21DD
_wcslen.LIBCMT ref: 00EE2213
GetMenuItemID.USER32(?,?), ref: 00EE224D
GetSubMenu.USER32(?,?), ref: 00EE225B

Part of subcall function 00EB3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EB3A57
Part of subcall function 00EB3A3D: GetCurrentThreadId.KERNEL32 ref: 00EB3A5E
Part of subcall function 00EB3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00EB25B3), ref: 00EB3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00EE22E3

Part of subcall function 00EBE97B: Sleep.KERNELBASE ref: 00EBE9F3

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: f781394db04dd8e91ebdc172549be762abea24174884ee41200a9444851a269f
Instruction ID: ed6304bd6b058a4430a17f2dce0cfd01c4727f121e623edb35bbf5db0e4ca987
Opcode Fuzzy Hash: f781394db04dd8e91ebdc172549be762abea24174884ee41200a9444851a269f
Instruction Fuzzy Hash: 69718D75A00249AFCB10DF65C881AAEBBF9EF88314F14945DEA16FB351D734EE418B90

Function 00EE7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(010E6480), ref: 00EE7F37
IsWindowEnabled.USER32(010E6480), ref: 00EE7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00EE801E
SendMessageW.USER32(010E6480,000000B0,?,?), ref: 00EE8051
IsDlgButtonChecked.USER32(?,?), ref: 00EE8089
GetWindowLongW.USER32(010E6480,000000EC), ref: 00EE80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00EE80C3

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 5786ee30bd7d796ca2b5a3008290d1c60feed8fd4f7ab12e97148926c2540fd3
Instruction ID: e2fa87fcdc2b54f1577d8c5175a966159b1acf6818cc0e44ba4e1fda26585058
Opcode Fuzzy Hash: 5786ee30bd7d796ca2b5a3008290d1c60feed8fd4f7ab12e97148926c2540fd3
Instruction Fuzzy Hash: 9A718C3460828CAFEB259F66C894FEA7BB9FF09304F145459F985B7261CB31A845DB10

Function 00EBAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00EBAEF9
GetKeyboardState.USER32(?), ref: 00EBAF0E
SetKeyboardState.USER32(?), ref: 00EBAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00EBAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00EBAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00EBAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00EBB020

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: e3bde42c8f28e3b6f38bd608a82391a53f58aaf674dbca31b55a327bc8810ca4
Instruction ID: 3b04fbada93c49a454335f0368a7aa244abd88bf5696c4b58231c749f3caffa1
Opcode Fuzzy Hash: e3bde42c8f28e3b6f38bd608a82391a53f58aaf674dbca31b55a327bc8810ca4
Instruction Fuzzy Hash: A751DFA0A046D57DFB369234C845BFBBEE95B06308F0C9499E1E9658D2C3E8E8C8D751

Function 00EBACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00EBAD19
GetKeyboardState.USER32(?), ref: 00EBAD2E
SetKeyboardState.USER32(?), ref: 00EBAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00EBADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00EBADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00EBAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00EBAE38

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 3718cdf1931cfdd6412920d74bcc3279a17bd9c440c68ab1ace7de5011b1a2d2
Instruction ID: ae1aef5a961deaaf72a845d08770a7d85ba52152f5286f6692362eb8b6764eb6
Opcode Fuzzy Hash: 3718cdf1931cfdd6412920d74bcc3279a17bd9c440c68ab1ace7de5011b1a2d2
Instruction Fuzzy Hash: 6951D3A15047D53DFF3383248C95BFBBEE95B46308F0C9598E1D5668D2C294EC88D762

Function 00E8542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00E93CD6,?,?,?,?,?,?,?,?,00E85BA3,?,?,00E93CD6,?,?), ref: 00E85470
__fassign.LIBCMT ref: 00E854EB
__fassign.LIBCMT ref: 00E85506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00E93CD6,00000005,00000000,00000000), ref: 00E8552C
WriteFile.KERNEL32(?,00E93CD6,00000000,00E85BA3,00000000,?,?,?,?,?,?,?,?,?,00E85BA3,?), ref: 00E8554B
WriteFile.KERNEL32(?,?,00000001,00E85BA3,00000000,?,?,?,?,?,?,?,?,?,00E85BA3,?), ref: 00E85584

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 62daef8c8efc40eb0a7a73d7778fb0723e1222071df2f9701c0716337e8415ac
Instruction ID: 2605eb678539587bb719e9b29b7a65fd70b249dd9d73587941ee56912cf7b706
Opcode Fuzzy Hash: 62daef8c8efc40eb0a7a73d7778fb0723e1222071df2f9701c0716337e8415ac
Instruction Fuzzy Hash: 9C51A272A006499FDB10DFA8D885AEEBBF9EF09300F14515AF959F7291DB309A41CF60

Function 00ED10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00ED307A
Part of subcall function 00ED304E: _wcslen.LIBCMT ref: 00ED309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00ED1112
WSAGetLastError.WSOCK32 ref: 00ED1121
WSAGetLastError.WSOCK32 ref: 00ED11C9
closesocket.WSOCK32(00000000), ref: 00ED11F9

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 0b5f4637ece1d3cd883d07ec95cc22a2dc763e167336099638ea643fd3161d20
Instruction ID: 6268aa167871469a2134e4bb9341585e1815b320acc87486617666316a203dcf
Opcode Fuzzy Hash: 0b5f4637ece1d3cd883d07ec95cc22a2dc763e167336099638ea643fd3161d20
Instruction Fuzzy Hash: 7641D631600218AFDB109F64C884BA9B7E9EF45368F14909AFD15BF391C770AD46CBA1

Function 00EBCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00EBCF22,?), ref: 00EBDDFD

Part of subcall function 00EBDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00EBCF22,?), ref: 00EBDE16

lstrcmpiW.KERNEL32(?,?), ref: 00EBCF45
MoveFileW.KERNEL32(?,?), ref: 00EBCF7F
_wcslen.LIBCMT ref: 00EBD005
_wcslen.LIBCMT ref: 00EBD01B
SHFileOperationW.SHELL32(?), ref: 00EBD061

Strings

\*.*, xrefs: 00EBCFF3

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: f13c47637809d6cb323c505ee836a5e749eea6c430471c095112b4cee9032c0b
Instruction ID: 79017eb695c34971361d577403317ba60636e4951d84160e313e62a0b1c25159
Opcode Fuzzy Hash: f13c47637809d6cb323c505ee836a5e749eea6c430471c095112b4cee9032c0b
Instruction Fuzzy Hash: 4F4156719092199FDF12EFA4DD81AEEB7F9AF08340F1410E6E509FB142EB34A649CB50

Function 00EE2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00EE2E1C
GetWindowLongW.USER32(?,000000F0), ref: 00EE2E4F
GetWindowLongW.USER32(?,000000F0), ref: 00EE2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00EE2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00EE2EE0
GetWindowLongW.USER32(?,000000F0), ref: 00EE2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00EE2F0B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 3a76af6720aa8ce085d7a29b7447d228fa2968c16b4c1c0f3d9f082aea53363d
Instruction ID: 2889ddca6bd2d8ee96cb337bd64c400411d432e46860c7e0b134ba197b50d652
Opcode Fuzzy Hash: 3a76af6720aa8ce085d7a29b7447d228fa2968c16b4c1c0f3d9f082aea53363d
Instruction Fuzzy Hash: 0E312A306042A99FEB22CF5ADC84F6537E8FB5A714F1411A8FA00AF2B1CB71AC45DB41

Function 00EB7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EB7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EB778F
SysAllocString.OLEAUT32(00000000), ref: 00EB7792
SysAllocString.OLEAUT32(?), ref: 00EB77B0
SysFreeString.OLEAUT32(?), ref: 00EB77B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00EB77DE
SysAllocString.OLEAUT32(?), ref: 00EB77EC

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 9b3fbb118ad7874d309613af0590679cb417d604400465bf68943ce12fe582bf
Instruction ID: fb1c15d1181cad3d8d29d48d9e2aa2e24c6fa7f8d2f777957eb0b39054e1894a
Opcode Fuzzy Hash: 9b3fbb118ad7874d309613af0590679cb417d604400465bf68943ce12fe582bf
Instruction Fuzzy Hash: 1C21B276604229AFDB10DFA9DC88CFB77ACEB493647108026F954EF1A0DA70DC46C760

Function 00EB77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EB7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00EB7868
SysAllocString.OLEAUT32(00000000), ref: 00EB786B
SysAllocString.OLEAUT32 ref: 00EB788C
SysFreeString.OLEAUT32 ref: 00EB7895
StringFromGUID2.OLE32(?,?,00000028), ref: 00EB78AF
SysAllocString.OLEAUT32(?), ref: 00EB78BD

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 6eb7cb635d03205d0d338d1bc208e2661905f0e7efea61c1019c250839738975
Instruction ID: 2c12608c6d42c70680772f4526b4c583de50b89d187ecee75a56de928ac0dcd4
Opcode Fuzzy Hash: 6eb7cb635d03205d0d338d1bc208e2661905f0e7efea61c1019c250839738975
Instruction Fuzzy Hash: 4A21B331608218AFDB149FB9EC8CDEB77ECEB483647108125F955EB2A1D670DC45CB64

Function 00EC04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00EC04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00EC052E

Strings

nul, xrefs: 00EC0567

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 2501f3ea212b8cfe2da320060ec9eac05b97562fdbef4ac468ff17df7b955e4d
Instruction ID: 47bcbd280d336eac404eadd1a477ab93373155cea04556c48fa67d5c560f7fe9
Opcode Fuzzy Hash: 2501f3ea212b8cfe2da320060ec9eac05b97562fdbef4ac468ff17df7b955e4d
Instruction Fuzzy Hash: F7213975500309EFDF309F29D944F9A7BA4AF44728F204A1DF8A1A62E0D7729956CF20

Function 00EC05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00EC05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00EC0601

Strings

nul, xrefs: 00EC0639

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: e5aa482e3b2ebb23fe300c869b80a98075d5971effafde6d7c5619c581427e7b
Instruction ID: 19b0d7f6a6760c153d97edaa0568142f7d503f03eb97cd62007dee15256e10ea
Opcode Fuzzy Hash: e5aa482e3b2ebb23fe300c869b80a98075d5971effafde6d7c5619c581427e7b
Instruction Fuzzy Hash: B921A175500315DFDB208F699D44F9A77E8AF85B24F200A1DF8A1F72E0D7729862CB10

Function 00EE40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00E5604C
Part of subcall function 00E5600E: GetStockObject.GDI32(00000011), ref: 00E56060
Part of subcall function 00E5600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E5606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00EE4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00EE411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00EE412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00EE4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00EE4145

Strings

Msctls_Progress32, xrefs: 00EE40E3

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: e8e15c7e912f2750c35ac5d9c2a945e70a6432c555bb9cdac8b7aad5da02a30f
Instruction ID: 26f4e22ccbf2228fc7836ea216986db1bd99c22dd40a86a12f1640dd6290428e
Opcode Fuzzy Hash: e8e15c7e912f2750c35ac5d9c2a945e70a6432c555bb9cdac8b7aad5da02a30f
Instruction Fuzzy Hash: 8E11B2B214021DBEEF219F65CC85EE77FADEF08798F015110BA18A6190C676DC61DBA4

Function 00E8D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E8D7A3: _free.LIBCMT ref: 00E8D7CC

_free.LIBCMT ref: 00E8D82D

Part of subcall function 00E829C8: HeapFree.KERNEL32(00000000,00000000,?,00E8D7D1,00000000,00000000,00000000,00000000,?,00E8D7F8,00000000,00000007,00000000,?,00E8DBF5,00000000), ref: 00E829DE
Part of subcall function 00E829C8: GetLastError.KERNEL32(00000000,?,00E8D7D1,00000000,00000000,00000000,00000000,?,00E8D7F8,00000000,00000007,00000000,?,00E8DBF5,00000000,00000000), ref: 00E829F0

_free.LIBCMT ref: 00E8D838
_free.LIBCMT ref: 00E8D843
_free.LIBCMT ref: 00E8D897
_free.LIBCMT ref: 00E8D8A2
_free.LIBCMT ref: 00E8D8AD
_free.LIBCMT ref: 00E8D8B8

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: eadf65006bfe65f3c9bbc05fad1e13c020ba1249290081ed59f91892b444a347
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: E1112E71584B04AAD621BFB0CC47FCF7BDCAF44700F40582AF29DB64D2DA6AB5058760

Function 00EBDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00EBDA74
LoadStringW.USER32(00000000), ref: 00EBDA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00EBDA91
LoadStringW.USER32(00000000), ref: 00EBDA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00EBDADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00EBDAB9

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 4453eb5f9be7bba0211b0533dee4e788faeed0fc295654d91d46c25c9421aa50
Instruction ID: dd613a057cf6d6d2b25307c93216fc9f5a0e786e26eccf87d02c6d362606ff5b
Opcode Fuzzy Hash: 4453eb5f9be7bba0211b0533dee4e788faeed0fc295654d91d46c25c9421aa50
Instruction Fuzzy Hash: 460162F250024CBFEB109BA19DC9EE7736CEB08701F500492B71AF6041E6749E898F74

Function 00EC096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(010DF948,010DF948), ref: 00EC097B
EnterCriticalSection.KERNEL32(010DF928,00000000), ref: 00EC098D
TerminateThread.KERNEL32(?,000001F6), ref: 00EC099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00EC09A9
CloseHandle.KERNEL32(?), ref: 00EC09B8
InterlockedExchange.KERNEL32(010DF948,000001F6), ref: 00EC09C8
LeaveCriticalSection.KERNEL32(010DF928), ref: 00EC09CF

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 3a8ed1d94fe754081ff32376d3b923515ada605e3b46b4ea85cdf76082c5e88a
Instruction ID: 5e5fe2ba661e9fd957b4af07d8474dd7374312a88411fc9e7dc824d4d45639f7
Opcode Fuzzy Hash: 3a8ed1d94fe754081ff32376d3b923515ada605e3b46b4ea85cdf76082c5e88a
Instruction Fuzzy Hash: 94F01932442A46EFD7425BA5EEC8BD6BA39BF45702F502025F202A88B1C775946ACF90

Function 00ED1C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00ED1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00ED1DE1
WSAGetLastError.WSOCK32 ref: 00ED1DF2
htons.WSOCK32(?,?,?,?,?), ref: 00ED1EDB
inet_ntoa.WSOCK32(?), ref: 00ED1E8C

Part of subcall function 00EB39E8: _strlen.LIBCMT ref: 00EB39F2

Part of subcall function 00ED3224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00ECEC0C), ref: 00ED3240

_strlen.LIBCMT ref: 00ED1F35

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 7ca3f7781ce9460edf7be3cde3943e1ce9c44bdd1f52b8648ac0e82a4fd7bf61
Instruction ID: ee2a97231a26791ea47850bae231a94b0968434208ba6f9ba875174788c54a1e
Opcode Fuzzy Hash: 7ca3f7781ce9460edf7be3cde3943e1ce9c44bdd1f52b8648ac0e82a4fd7bf61
Instruction Fuzzy Hash: 30B1B031204340AFC324DF24C885E6A77E5EF84318F54A98DF8566B3A2DB71ED46CB91

Function 00E55D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00E55D30
GetWindowRect.USER32(?,?), ref: 00E55D71
ScreenToClient.USER32(?,?), ref: 00E55D99
GetClientRect.USER32(?,?), ref: 00E55ED7
GetWindowRect.USER32(?,?), ref: 00E55EF8

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 47fac3ff1819ae4762e3cfac6d8d9601baedb050fd5e49b09eb7607a06592895
Instruction ID: 59f918fe59e7c78620de23be7fa06ca29eac4b316e0aad318f8fe70e6e13537d
Opcode Fuzzy Hash: 47fac3ff1819ae4762e3cfac6d8d9601baedb050fd5e49b09eb7607a06592895
Instruction Fuzzy Hash: 50B17D75A0064ADBDF14CFA9C481BEEB7F1FF44315F14A81AE8A9E7250DB30AA45CB50

Function 00E801B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00E800BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E800D6
__allrem.LIBCMT ref: 00E800ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E8010B
__allrem.LIBCMT ref: 00E80122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E80140

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: 2613210ff04abbd60585775583973f27d03b6f1217c7b91e691c2fc378f0b8c9
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 2081E572A01B06AFE724AE68CC41B6A73E9AF41734F24A53AF55DF6281EB70D9048750

Function 00E861FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00E782D9,00E782D9,?,?,?,00E8644F,00000001,00000001,?), ref: 00E86258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00E8644F,00000001,00000001,?,?,?,?), ref: 00E862DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00E863D8
__freea.LIBCMT ref: 00E863E5

Part of subcall function 00E83820: RtlAllocateHeap.NTDLL(00000000,?,00F21444,?,00E6FDF5,?,?,00E5A976,00000010,00F21440,00E513FC,?,00E513C6,?,00E51129), ref: 00E83852

__freea.LIBCMT ref: 00E863EE
__freea.LIBCMT ref: 00E86413

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 8b8c25d695712d3e0a4cf79deea9b4f75f9f9eefadf8d8260f46b9d7aba7a41b
Instruction ID: 1d7cdff645024766ba3c9af59764c0568b45ae6abdb66f39c8457f0431a9f3fd
Opcode Fuzzy Hash: 8b8c25d695712d3e0a4cf79deea9b4f75f9f9eefadf8d8260f46b9d7aba7a41b
Instruction Fuzzy Hash: BC51E272A00616AFEB25AF64DC81EAF77AAEB94714F245269FC0DF6150EB34DC40C760

Function 00EDBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

Part of subcall function 00EDC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00EDB6AE,?,?), ref: 00EDC9B5
Part of subcall function 00EDC998: _wcslen.LIBCMT ref: 00EDC9F1
Part of subcall function 00EDC998: _wcslen.LIBCMT ref: 00EDCA68
Part of subcall function 00EDC998: _wcslen.LIBCMT ref: 00EDCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00EDBCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00EDBD25
RegCloseKey.ADVAPI32(00000000), ref: 00EDBD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00EDBD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00EDBDF3
RegCloseKey.ADVAPI32(?), ref: 00EDBDFF

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 887a36a1d67cab24c1b2c84776a60b56823da4f644fb8d5ae598ba931e2bdef4
Instruction ID: 2e21804ca7f0ff8011e280f2beaf3f5ef688ffcc1e3584e987f4c2dac62ff082
Opcode Fuzzy Hash: 887a36a1d67cab24c1b2c84776a60b56823da4f644fb8d5ae598ba931e2bdef4
Instruction Fuzzy Hash: 2E81A030208241EFC714DF24C885E6ABBE5FF84308F15995DF4599B2A2DB31ED4ACB92

Function 00EAF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00EAF7B9
SysAllocString.OLEAUT32(00000001), ref: 00EAF860
VariantCopy.OLEAUT32(00EAFA64,00000000), ref: 00EAF889
VariantClear.OLEAUT32(00EAFA64), ref: 00EAF8AD
VariantCopy.OLEAUT32(00EAFA64,00000000), ref: 00EAF8B1
VariantClear.OLEAUT32(?), ref: 00EAF8BB

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 3bfaf0ebd73f44c4b089689d0469d2f478cc87832bbd912f15ec1d99abd230e9
Instruction ID: 43419a201911c81e715d97c2d2af62377603b77347659cd8d7246383dce4263c
Opcode Fuzzy Hash: 3bfaf0ebd73f44c4b089689d0469d2f478cc87832bbd912f15ec1d99abd230e9
Instruction Fuzzy Hash: 0351C631500310BACF24ABE5D895B6AB3E5EF8A314F246466F805FF292DB74AC41C796

Function 00EC910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00E57620: _wcslen.LIBCMT ref: 00E57625

Part of subcall function 00E56B57: _wcslen.LIBCMT ref: 00E56B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00EC94E5
_wcslen.LIBCMT ref: 00EC9506
_wcslen.LIBCMT ref: 00EC952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00EC9585

Strings

X, xrefs: 00EC9412

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: d939a3d8c6d5f4053fb0929b8e918c7953b8470f48b30fc5e0e3b08dacc4ecc3
Instruction ID: eefefaa107d2ab85bc7082c5be1141fe023e6e3bcbdbae5bf81444fd5458f131
Opcode Fuzzy Hash: d939a3d8c6d5f4053fb0929b8e918c7953b8470f48b30fc5e0e3b08dacc4ecc3
Instruction Fuzzy Hash: D3E19D315083408FC724DF24C985F6AB7E5BF85314F14996DF899AB2A2EB31DD06CB92

Function 00E6920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00E69BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E69BB2

BeginPaint.USER32(?,?,?), ref: 00E69241
GetWindowRect.USER32(?,?), ref: 00E692A5
ScreenToClient.USER32(?,?), ref: 00E692C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00E692D3
EndPaint.USER32(?,?,?,?,?), ref: 00E69321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00EA71EA

Part of subcall function 00E69339: BeginPath.GDI32(00000000), ref: 00E69357

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: cf58e2eaac6f723c5eb320d5fa51d12c43bad413e03dc524563933b18a1ca9d6
Instruction ID: b9bc519cb28ccbdb29a2ee7b98a4fc2ff256010bdb1ca54c0e70118c19f591a9
Opcode Fuzzy Hash: cf58e2eaac6f723c5eb320d5fa51d12c43bad413e03dc524563933b18a1ca9d6
Instruction Fuzzy Hash: 4341E230145344AFD720DF24EC94FBA7BF8FB5A764F100229F994AB2A2C7309846DB61

Function 00EC07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00EC080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00EC0847
EnterCriticalSection.KERNEL32(?), ref: 00EC0863
LeaveCriticalSection.KERNEL32(?), ref: 00EC08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00EC08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00EC0921

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 64419f416c42bc926da6b2d037a4f3900402f4546c77cebc05e7f6cd25331e63
Instruction ID: 20516880f1a5662d1f284e54a342ebf83faaaa63c89423786aec2bc3fb8445a5
Opcode Fuzzy Hash: 64419f416c42bc926da6b2d037a4f3900402f4546c77cebc05e7f6cd25331e63
Instruction Fuzzy Hash: 7E416A71900209EFDF149F54EC85AAA7BB8FF44314F1480A9ED04AE297D731DE66DBA0

Function 00EE81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00EAF3AB,00000000,?,?,00000000,?,00EA682C,00000004,00000000,00000000), ref: 00EE824C
EnableWindow.USER32(?,00000000), ref: 00EE8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00EE82D1
ShowWindow.USER32(?,00000004), ref: 00EE82E5
EnableWindow.USER32(?,00000001), ref: 00EE830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00EE832F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 3c6314b75dc5c55d83a4049dc74b6c5cc40a1497ed0282462f0dbbef8158f2d2
Instruction ID: 4f8b4bd7d8b8b862c6e884a8f78807c71c9e4d0aee3d0ec52da9341d32339716
Opcode Fuzzy Hash: 3c6314b75dc5c55d83a4049dc74b6c5cc40a1497ed0282462f0dbbef8158f2d2
Instruction Fuzzy Hash: 7041B73060168CEFDB25CF16C995BE47BE0BB0A718F186165E64C6F272C7325846CB50

Function 00EB4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00EB4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00EB4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00EB4CEA
_wcslen.LIBCMT ref: 00EB4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00EB4D10
_wcsstr.LIBVCRUNTIME ref: 00EB4D1A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 0638e8f676a5de5fa9aa9da5764633dc1a6391c9cb78dfe6c7346906be270b7f
Instruction ID: 08a77f0cd9ef2aeb99819bc4c8633059f64105c44079b73708296646ca52ec6c
Opcode Fuzzy Hash: 0638e8f676a5de5fa9aa9da5764633dc1a6391c9cb78dfe6c7346906be270b7f
Instruction Fuzzy Hash: 9D2129B22042457BEB155B39EC49EBB7FECDF45B54F109039F805EA1D2EA61CC0186A1

Function 00EB175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00EB0FCA
Part of subcall function 00EB0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00EB0FD6
Part of subcall function 00EB0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00EB0FE5
Part of subcall function 00EB0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00EB0FEC
Part of subcall function 00EB0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00EB1002

GetLengthSid.ADVAPI32(?,00000000,00EB1335), ref: 00EB17AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00EB17BA
HeapAlloc.KERNEL32(00000000), ref: 00EB17C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00EB17DA
GetProcessHeap.KERNEL32(00000000,00000000,00EB1335), ref: 00EB17EE
HeapFree.KERNEL32(00000000), ref: 00EB17F5

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: bbfa0369622608273616c612b48e1f23ba84322d0b56b3d3c83d3b214c934c24
Instruction ID: 2905494fe5085b400020e52728e76ad70e81fc31408188eebbc82b732b2af900
Opcode Fuzzy Hash: bbfa0369622608273616c612b48e1f23ba84322d0b56b3d3c83d3b214c934c24
Instruction Fuzzy Hash: 2911DF32601218FFDB108FA4DC98BEF7BB8EB42369F604059F441BB110CB31A945CB60

Function 00EB14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00EB14FF
OpenProcessToken.ADVAPI32(00000000), ref: 00EB1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00EB1515
CloseHandle.KERNEL32(00000004), ref: 00EB1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00EB154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00EB1563

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: a711e3787564c9b0cdc91a9bd852a93f47ccaf39f244a4dc9c44c3c86ab0c0f4
Instruction ID: 4913ed35e9dbcaf4727e8ed513812d421242f7a25d798f5442b24a9c8fa52481
Opcode Fuzzy Hash: a711e3787564c9b0cdc91a9bd852a93f47ccaf39f244a4dc9c44c3c86ab0c0f4
Instruction Fuzzy Hash: 1811647210124DAFDB11CFA8ED89BDE3BA9EB48718F144065FA05B6060C3718E659B60

Function 00E73382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E73379,00E72FE5), ref: 00E73390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E7339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E733B7
SetLastError.KERNEL32(00000000,?,00E73379,00E72FE5), ref: 00E73409

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4291a6d9ccb449465ebe9b3a2b298d9067a614434962ab009bb587e39ecea10b
Instruction ID: 45e361ba0b58ffe6b7bb1e0305e353c68b6a89ece66228e52916667f1706cb82
Opcode Fuzzy Hash: 4291a6d9ccb449465ebe9b3a2b298d9067a614434962ab009bb587e39ecea10b
Instruction Fuzzy Hash: 9F012432648316BEA6A567B47C859A72E95EB09379330E22DF538F41F0EF114E027284

Function 00E82D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E85686,00E93CD6,?,00000000,?,00E85B6A,?,?,?,?,?,00E7E6D1,?,00F18A48), ref: 00E82D78
_free.LIBCMT ref: 00E82DAB
_free.LIBCMT ref: 00E82DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00E7E6D1,?,00F18A48,00000010,00E54F4A,?,?,00000000,00E93CD6), ref: 00E82DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00E7E6D1,?,00F18A48,00000010,00E54F4A,?,?,00000000,00E93CD6), ref: 00E82DEC
_abort.LIBCMT ref: 00E82DF2

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 8da938522bb486a4e1d86d8ef98c2d07e6a2fe748ab3e9204bc3ba340be62185
Instruction ID: 4272e65fbdbe8cf33c0fa0e65e471aa61b4eb6979872bcb2c0357c118aded87f
Opcode Fuzzy Hash: 8da938522bb486a4e1d86d8ef98c2d07e6a2fe748ab3e9204bc3ba340be62185
Instruction Fuzzy Hash: A8F0C836585A003BC6123739BC06E5B2999AFC1BA5F35641CFA2CB61E2EF2498025361

Function 00EE8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00E69639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00E69693
Part of subcall function 00E69639: SelectObject.GDI32(?,00000000), ref: 00E696A2
Part of subcall function 00E69639: BeginPath.GDI32(?), ref: 00E696B9
Part of subcall function 00E69639: SelectObject.GDI32(?,00000000), ref: 00E696E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00EE8A4E
LineTo.GDI32(?,00000003,00000000), ref: 00EE8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00EE8A70
LineTo.GDI32(?,00000000,00000003), ref: 00EE8A80
EndPath.GDI32(?), ref: 00EE8A90
StrokePath.GDI32(?), ref: 00EE8AA0

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: f23458d0c0e706571eba9c16dbf2f5bb6c54a87cdc046441ea6fc3ddacaddb3b
Instruction ID: 20874dfdabb87afaf9064ae554249bcf8a87d8e7383148b0670f00111a3da6db
Opcode Fuzzy Hash: f23458d0c0e706571eba9c16dbf2f5bb6c54a87cdc046441ea6fc3ddacaddb3b
Instruction Fuzzy Hash: 85111E7600014CFFDF129F91DC88E9A7F6CEB04354F108021FA19AA161C7719D56DFA0

Function 00EB51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00EB5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00EB5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00EB5230
ReleaseDC.USER32(00000000,00000000), ref: 00EB5238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00EB524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00EB5261

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 2c80379221d62acdb4e67cee341e9ba5841c3c446c63351a1c6af0751c386406
Instruction ID: 9dd36b562e9cfd89280ed62621826e3cae1e2d973816253dc5f79bf1b6530ce7
Opcode Fuzzy Hash: 2c80379221d62acdb4e67cee341e9ba5841c3c446c63351a1c6af0751c386406
Instruction Fuzzy Hash: B1018475A01709BFEB109BE69C49B4FBFB8EB48751F144065FA04BB290D6709805CBA0

Function 00E51BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00E51BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00E51BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00E51C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00E51C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00E51C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E51C22

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: f7abc0b5432005182d6ee19a6837458800b770d1a6e89a61fced5ee88a084b1a
Instruction ID: 4bd07c505fc6152e2a72befa4e94deed2dafa5055ef939384593b5aa101c9202
Opcode Fuzzy Hash: f7abc0b5432005182d6ee19a6837458800b770d1a6e89a61fced5ee88a084b1a
Instruction Fuzzy Hash: DF0148B090275A7DE3008F5A8C85A52FFA8FF19754F00411BA15C4B941C7B5A864CBE5

Function 00EBEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00EBEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00EBEB46
GetWindowThreadProcessId.USER32(?,?), ref: 00EBEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00EBEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00EBEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00EBEB75

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: e99ccf42b0a0f1207e87163e70f8d6a5f719caad4ae023af9452bc65e78e2977
Instruction ID: fb362756c8ccb6d0472a3812f52b158c4808e1ac3a46eeca84db2d18df5f1509
Opcode Fuzzy Hash: e99ccf42b0a0f1207e87163e70f8d6a5f719caad4ae023af9452bc65e78e2977
Instruction Fuzzy Hash: 17F01D72141199BFE62157539C4DEEB3A7CEBCAF11F100158FA01E519196A05A0686B5

Function 00EA7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00EA7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00EA7469
GetWindowDC.USER32(?), ref: 00EA7475
GetPixel.GDI32(00000000,?,?), ref: 00EA7484
ReleaseDC.USER32(?,00000000), ref: 00EA7496
GetSysColor.USER32(00000005), ref: 00EA74B0

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 83d1126d0018de87e8ba3be9cb84d612bf9e2577d56319639663863281f9c2ae
Instruction ID: d71c6d1bb49cf4817cb709288b96d9983b87550964610fa91877a7dd716878ed
Opcode Fuzzy Hash: 83d1126d0018de87e8ba3be9cb84d612bf9e2577d56319639663863281f9c2ae
Instruction Fuzzy Hash: BB018B31400259EFDB109F65DC48BEA7FB6FB08311F200064F926BA0A1CB312E46AB51

Function 00EB1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00EB187F
UnloadUserProfile.USERENV(?,?), ref: 00EB188B
CloseHandle.KERNEL32(?), ref: 00EB1894
CloseHandle.KERNEL32(?), ref: 00EB189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00EB18A5
HeapFree.KERNEL32(00000000), ref: 00EB18AC

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 5914b96b7e0c6bef9d5ec940109fa0cc983be61365699ad7a185f0cbd4e75a52
Instruction ID: 5d9951eeaec6bd5f62880e1c24895cef3d105e60d16baed837a8355ee013ae8e
Opcode Fuzzy Hash: 5914b96b7e0c6bef9d5ec940109fa0cc983be61365699ad7a185f0cbd4e75a52
Instruction Fuzzy Hash: 0DE0E536004249BFDB015FA2ED4C90ABF39FF4AB22B208221F625A9071CB329466DF50

Function 00ED7B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00E70242: EnterCriticalSection.KERNEL32(00F2070C,00F21884,?,?,00E6198B,00F22518,?,?,?,00E512F9,00000000), ref: 00E7024D
Part of subcall function 00E70242: LeaveCriticalSection.KERNEL32(00F2070C,?,00E6198B,00F22518,?,?,?,00E512F9,00000000), ref: 00E7028A

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

Part of subcall function 00E700A3: __onexit.LIBCMT ref: 00E700A9

__Init_thread_footer.LIBCMT ref: 00ED7BFB

Part of subcall function 00E701F8: EnterCriticalSection.KERNEL32(00F2070C,?,?,00E68747,00F22514), ref: 00E70202
Part of subcall function 00E701F8: LeaveCriticalSection.KERNEL32(00F2070C,?,00E68747,00F22514), ref: 00E70235

Strings

+T, xrefs: 00ED7E2E
Variable must be of type 'Object'., xrefs: 00ED7C3A
5, xrefs: 00ED7C78
G, xrefs: 00ED7C7F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +T$5$G$Variable must be of type 'Object'.
API String ID: 535116098-4125810065
Opcode ID: 2f463b7114a03763ed618b107775a1600d2d52df30a158b0040340ec3943dc58
Instruction ID: 5ade63db700016c69ba50ef18262055b84726197d74c380c961b9815b8ee4ccf
Opcode Fuzzy Hash: 2f463b7114a03763ed618b107775a1600d2d52df30a158b0040340ec3943dc58
Instruction Fuzzy Hash: E5916C70A04209EFCB14EF54D8919ADB7B2EF49304F14905AF8867B392EB71AE46CB51

Function 00EBC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E57620: _wcslen.LIBCMT ref: 00E57625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00EBC6EE
_wcslen.LIBCMT ref: 00EBC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00EBC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00EBC7CA

Strings

0, xrefs: 00EBC6AF

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 522ca96188ad14c35c0baf39b6526af5cd293f184d29b4a66fbbe3e8736d60a3
Instruction ID: cdeae516628ec16d71cc2065c74640ef0e16e9cb044419a6fce450edc9e54ca2
Opcode Fuzzy Hash: 522ca96188ad14c35c0baf39b6526af5cd293f184d29b4a66fbbe3e8736d60a3
Instruction Fuzzy Hash: A551EF716083119BD7149F38D885BEB77E8AF89718F242A2EF995F31A0DB60D844CB52

Function 00EDAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00EDAEA3

Part of subcall function 00E57620: _wcslen.LIBCMT ref: 00E57625

GetProcessId.KERNEL32(00000000), ref: 00EDAF38
CloseHandle.KERNEL32(00000000), ref: 00EDAF67

Strings

@, xrefs: 00EDAE72
<, xrefs: 00EDAE6B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: bad4407bd71608199b345d375ae6259e28dbf8b8473cdf043c22acb41fc9e3a4
Instruction ID: e3dfeeac6675f924ec186cd9f8f7361ad69c4ae699d7ccad2be7155012680b4b
Opcode Fuzzy Hash: bad4407bd71608199b345d375ae6259e28dbf8b8473cdf043c22acb41fc9e3a4
Instruction Fuzzy Hash: 58716A71A00215DFCB14DF54D484A9EBBF1EF08314F0898AAE856BB352C774EE46CB91

Function 00EB719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00EB7206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00EB723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00EB724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00EB72CF

Strings

DllGetClassObject, xrefs: 00EB7242

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 8c640bfe77dc33c5ba308314d26eeb02cc676869b2dafb379be3e596ddd8130d
Instruction ID: cde013dc97e24d5f5cbb81e7ff87b5b47ef50dcce3aef97d3096097441b44a72
Opcode Fuzzy Hash: 8c640bfe77dc33c5ba308314d26eeb02cc676869b2dafb379be3e596ddd8130d
Instruction Fuzzy Hash: F3416EB1A04204AFDB15CF54C884ADB7BB9EF84314F2490ADFD45AF61AD7B0DA45CBA0

Function 00EE3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00EE3E35
IsMenu.USER32(?), ref: 00EE3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00EE3E92
DrawMenuBar.USER32 ref: 00EE3EA5

Strings

0, xrefs: 00EE3D89

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 92860f8b89470bacd073b7ea512d5f87e9749fa1a610d5dff7516d86e495daeb
Instruction ID: 24ad664276495ad0ab648ed1ba97b1fd1cf1621466a7827d719d90272c6fbaec
Opcode Fuzzy Hash: 92860f8b89470bacd073b7ea512d5f87e9749fa1a610d5dff7516d86e495daeb
Instruction Fuzzy Hash: A0415775A0034DAFDB24DF62D888AEABBB9FF49354F045129F905AB260D730AE45CF50

Function 00EB1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

Part of subcall function 00EB3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EB3CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00EB1E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00EB1E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00EB1EA9

Part of subcall function 00E56B57: _wcslen.LIBCMT ref: 00E56B6A

Strings

ListBox, xrefs: 00EB1E25
ComboBox, xrefs: 00EB1DF0

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 3c60b6ed8f0484f3c7cb31b9f1e8ed396e9e1f79e79573e6754baec80f54642d
Instruction ID: d649de8f4cfb3c74d18dbbb8a5d977b44eb3ef8b88835794f294b3f6894bfa7e
Opcode Fuzzy Hash: 3c60b6ed8f0484f3c7cb31b9f1e8ed396e9e1f79e79573e6754baec80f54642d
Instruction Fuzzy Hash: 9B212771A00108BEDB14ABA4DC96CFFBBF9DF45364B606519FC25B71E1DB34890A9620

Function 00EE2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00EE2F8D
LoadLibraryW.KERNEL32(?), ref: 00EE2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00EE2FA9
DestroyWindow.USER32(?), ref: 00EE2FB1

Strings

SysAnimate32, xrefs: 00EE2F68

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 189a2aad17981d5b10cd0254a0912632c971c2ba82288801a5c490521c03fb0f
Instruction ID: bd41e19efaee3e34255222b2f5bd9ab81b2d35dc6d638451a3623b2b9ead31cd
Opcode Fuzzy Hash: 189a2aad17981d5b10cd0254a0912632c971c2ba82288801a5c490521c03fb0f
Instruction Fuzzy Hash: 61218B72600289ABEB204F669C81EBB37BDEB59368F10661CFA50F6190D771DC51D760

Function 00E74D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00E74D1E,00E828E9,(,00E74CBE,00000000,00F188B8,0000000C,00E74E15,(,00000002), ref: 00E74D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E74DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00E74D1E,00E828E9,(,00E74CBE,00000000,00F188B8,0000000C,00E74E15,(,00000002,00000000), ref: 00E74DC3

Strings

mscoree.dll, xrefs: 00E74D86
CorExitProcess, xrefs: 00E74D98

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 67289a73891dc4a9b896c059dd955bbcfa2b3d90aff1d85afdcdeadb0594c6b9
Instruction ID: 7bfd107ee8cccc86067a09debe119fe2ac803bcb3823bcd8e9e7b1215b0c1950
Opcode Fuzzy Hash: 67289a73891dc4a9b896c059dd955bbcfa2b3d90aff1d85afdcdeadb0594c6b9
Instruction Fuzzy Hash: 94F0AF30A4030CBFDB11AF91DC49BADBBB5EF04712F1040A8F909B62A0CB309945CB91

Function 00E54E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00E54EDD,?,00F21418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E54E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00E54EAE
FreeLibrary.KERNEL32(00000000,?,?,00E54EDD,?,00F21418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E54EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00E54EA8
kernel32.dll, xrefs: 00E54E94

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 068edb58c4920a695d6a656de85372f6e4b4ab5f6458e7c6029280bdc97705d6
Instruction ID: ae1dc246b42b7d0068053665cfcd35307353e3e8084528468705496ce7e65b43
Opcode Fuzzy Hash: 068edb58c4920a695d6a656de85372f6e4b4ab5f6458e7c6029280bdc97705d6
Instruction Fuzzy Hash: 97E08635A026265F922117266C19A5B6564AF82F6B7151515FD00FB140DF60CD4A40A2

Function 00E54E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00E93CDE,?,00F21418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E54E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00E54E74
FreeLibrary.KERNEL32(00000000,?,?,00E93CDE,?,00F21418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00E54E87

Strings

kernel32.dll, xrefs: 00E54E5B
Wow64RevertWow64FsRedirection, xrefs: 00E54E6E

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: d727f9d3273dc41d5a32345c0277f97c6de63197a73745d80476b60db8a103c6
Instruction ID: 152527f8b135f364e22c120c95547072a1625465edd7ac3e654aa004070eb68b
Opcode Fuzzy Hash: d727f9d3273dc41d5a32345c0277f97c6de63197a73745d80476b60db8a103c6
Instruction Fuzzy Hash: 22D0C2319036665B47221B266C19D8B2A28AF81F1A3151914BC00BA154CF20CD4A81D1

Function 00EC2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00EC2C05
DeleteFileW.KERNEL32(?), ref: 00EC2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00EC2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00EC2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00EC2CC0

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: f142bf4859829799d0768a1a6b87f4968bde2904d11a1e200676797bc063a998
Instruction ID: 7f1e17f90ef8ac3dbc182aaf2f0d53d18f9428c39381e7a0998449cac38c2ea9
Opcode Fuzzy Hash: f142bf4859829799d0768a1a6b87f4968bde2904d11a1e200676797bc063a998
Instruction Fuzzy Hash: 9CB16D72D0011DABDF21DBA4CD85EDEBBBDEF08350F1050AAFA09F6151EA319A458F61

Function 00EDA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00EDA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00EDA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00EDA468
CloseHandle.KERNEL32(?), ref: 00EDA63D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 104a18f41a6b23e93f9fec7c699c0690626aea9d02f844eaccedbcce0494adf2
Instruction ID: 85122ceac5fefcc57696ef7527f7c1f8ff274583d832ee8bc94c5fb9fd6f9171
Opcode Fuzzy Hash: 104a18f41a6b23e93f9fec7c699c0690626aea9d02f844eaccedbcce0494adf2
Instruction Fuzzy Hash: 67A1A1716043009FD720DF24D882F2AB7E5AF84714F18A85DF969AB392DB70ED45CB92

Function 00E8BB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00EF3700), ref: 00E8BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00F2121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00E8BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00F21270,000000FF,?,0000003F,00000000,?), ref: 00E8BC36
_free.LIBCMT ref: 00E8BB7F

Part of subcall function 00E829C8: HeapFree.KERNEL32(00000000,00000000,?,00E8D7D1,00000000,00000000,00000000,00000000,?,00E8D7F8,00000000,00000007,00000000,?,00E8DBF5,00000000), ref: 00E829DE
Part of subcall function 00E829C8: GetLastError.KERNEL32(00000000,?,00E8D7D1,00000000,00000000,00000000,00000000,?,00E8D7F8,00000000,00000007,00000000,?,00E8DBF5,00000000,00000000), ref: 00E829F0

_free.LIBCMT ref: 00E8BD4B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: ca63c4965f1244056ab75d6db0531c51541ea010551282f15358a1073cdcaee2
Instruction ID: 9f770701e6664dd392be8a4d5b310add8b23af9d1f9fde6cd257530f4b9d938b
Opcode Fuzzy Hash: ca63c4965f1244056ab75d6db0531c51541ea010551282f15358a1073cdcaee2
Instruction Fuzzy Hash: 3351C47190020DEFDB20FF699C819AEB7B8BF50314B10526AF56CF7191EB709E419B94

Function 00EBE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00EBCF22,?), ref: 00EBDDFD

Part of subcall function 00EBDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00EBCF22,?), ref: 00EBDE16

Part of subcall function 00EBE199: GetFileAttributesW.KERNEL32(?,00EBCF95), ref: 00EBE19A

lstrcmpiW.KERNEL32(?,?), ref: 00EBE473
MoveFileW.KERNEL32(?,?), ref: 00EBE4AC
_wcslen.LIBCMT ref: 00EBE5EB
_wcslen.LIBCMT ref: 00EBE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00EBE650

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 52661fc07e06cd69f8cb13f8ce6a79893e428413d4fe8fbe1bf967df1d5089fc
Instruction ID: 59f3663cdc4cf3a488dbd35a18905debe7899460816cc8fcffd9e9518d2fc54c
Opcode Fuzzy Hash: 52661fc07e06cd69f8cb13f8ce6a79893e428413d4fe8fbe1bf967df1d5089fc
Instruction Fuzzy Hash: E85197B24083859BC724DBA4DC819DFB3ECAF84344F10591EF589E3292EF74A58C8756

Function 00EDB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

Part of subcall function 00EDC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00EDB6AE,?,?), ref: 00EDC9B5
Part of subcall function 00EDC998: _wcslen.LIBCMT ref: 00EDC9F1
Part of subcall function 00EDC998: _wcslen.LIBCMT ref: 00EDCA68
Part of subcall function 00EDC998: _wcslen.LIBCMT ref: 00EDCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00EDBAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00EDBB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00EDBB63
RegCloseKey.ADVAPI32(?,?), ref: 00EDBBA6
RegCloseKey.ADVAPI32(00000000), ref: 00EDBBB3

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 418e38ec8e086bfd5468b82fc84886f0d5ff23d58aa7f3e6de15dc7c8d9d23d9
Instruction ID: 4b34e049e79ded2bca99b04b0c9b56ac8564cbf07bef9549ed4e3a1bec879f55
Opcode Fuzzy Hash: 418e38ec8e086bfd5468b82fc84886f0d5ff23d58aa7f3e6de15dc7c8d9d23d9
Instruction Fuzzy Hash: 38619D31208241EFC714DF14C490E6ABBE5FF84308F55995EF4999B2A2DB31ED4ACB92

Function 00EB8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00EB8BCD
VariantClear.OLEAUT32 ref: 00EB8C3E
VariantClear.OLEAUT32 ref: 00EB8C9D
VariantClear.OLEAUT32(?), ref: 00EB8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00EB8D3B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 8745c84e48939c06edb2be1142e21efc12655f3e3f0f051291a464e6a1307c9f
Instruction ID: 18944c3b5d84322463d2b386ab800555ea1d6aa78d00509bbc22cce28673ed1d
Opcode Fuzzy Hash: 8745c84e48939c06edb2be1142e21efc12655f3e3f0f051291a464e6a1307c9f
Instruction Fuzzy Hash: 6D5159B5A00219EFCB14CF58C894AAAB7F9FF89314B15855AF915EB350E730E911CF90

Function 00EC8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00EC8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00EC8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00EC8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00EC8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00EC8C5F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 35cf0a0c13d5e4996857cc24539c370fc5a11a73a229d0792ee3b7fdd9f619a8
Instruction ID: d8bd167610ceffe55e6e9ca06f9eb4752b58a6b143f300bed3b6183c06bc842c
Opcode Fuzzy Hash: 35cf0a0c13d5e4996857cc24539c370fc5a11a73a229d0792ee3b7fdd9f619a8
Instruction Fuzzy Hash: D8516B35A002189FCB04DF65C980E6DBBF5FF48314F089458E849AB362DB31ED56CB91

Function 00ED8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00ED8F40
GetProcAddress.KERNEL32(00000000,?), ref: 00ED8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00ED8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00ED9032
FreeLibrary.KERNEL32(00000000), ref: 00ED9052

Part of subcall function 00E6F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00EC1043,?,7529E610), ref: 00E6F6E6
Part of subcall function 00E6F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00EAFA64,00000000,00000000,?,?,00EC1043,?,7529E610,?,00EAFA64), ref: 00E6F70D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 9a6dcae6eaaddd9a9251338a07d5be6cbceed7749b567d1fb2dbf0169de8dfa4
Instruction ID: 7fefec1f9382997468d5fa0428449088a8b065445998fd6d88bdf7a1fe3b3b80
Opcode Fuzzy Hash: 9a6dcae6eaaddd9a9251338a07d5be6cbceed7749b567d1fb2dbf0169de8dfa4
Instruction Fuzzy Hash: 19514C35605209DFC715DF68C4848ADBBF1FF49318B149499E816AF362DB31ED8ACB90

Function 00EE6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00EE6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00EE6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00EE6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00ECAB79,00000000,00000000), ref: 00EE6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00EE6CC7

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: d412a41ced1664f98cb87c1df5c300854a8c89190a2a70f1da0947d9d14358bb
Instruction ID: 3e6f3300b2ee43799a3ebddb8e8c376f58256eb8be19333e11d7a313c38b135f
Opcode Fuzzy Hash: d412a41ced1664f98cb87c1df5c300854a8c89190a2a70f1da0947d9d14358bb
Instruction Fuzzy Hash: 4241D43560018CAFDB24CF2ACC94FA5BBA5EB19394F241228FC95BB3E0C371AD41DA40

Function 00E82051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E820C3
_free.LIBCMT ref: 00E820E3

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 7a33da031019189edb86436ed5a27d07a492e584940efdf2b48c8b3a2844f044
Instruction ID: 283653bb9d8c683c26fa6fd39c8bf5ccc48f3cf4dd5d650af9722a79d7e468c9
Opcode Fuzzy Hash: 7a33da031019189edb86436ed5a27d07a492e584940efdf2b48c8b3a2844f044
Instruction Fuzzy Hash: D741D372A002049FCB24EF78C884A5DB7E5EF88714F2645ACE61DFB391D631AD01CB80

Function 00E6912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00E69141
ScreenToClient.USER32(00000000,?), ref: 00E6915E
GetAsyncKeyState.USER32(00000001), ref: 00E69183
GetAsyncKeyState.USER32(00000002), ref: 00E6919D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 480e9d4e7b54d5ab4f35f59747fee2056578c538060128f3c45f346bb7d9f68d
Instruction ID: 8293d7f3eebc86747520b190ca84ac71d0718060f6b839714371482d1cabedef
Opcode Fuzzy Hash: 480e9d4e7b54d5ab4f35f59747fee2056578c538060128f3c45f346bb7d9f68d
Instruction Fuzzy Hash: E7419F31A0861AFBDF05DF68D844BEEB7B8FB0A364F209219E465B72D1C7306954CB91

Function 00EC3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00EC38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00EC3922
TranslateMessage.USER32(?), ref: 00EC394B
DispatchMessageW.USER32(?), ref: 00EC3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EC3966

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: d6ffcdf278f5fba6498a0023cc112772fb6274882e0f8ff32cd65368c1ab8a71
Instruction ID: 42f662bdbe90df5e9dcafe0e342fe1b89aea9dceb5b23484f0d74828628e7e8a
Opcode Fuzzy Hash: d6ffcdf278f5fba6498a0023cc112772fb6274882e0f8ff32cd65368c1ab8a71
Instruction Fuzzy Hash: 79312B705043859EEB34CB34DA48FF637A4BB51308F14912DE452E21D4D3B29A87DB11

Function 00ECCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00ECCF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00ECCF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00ECC21E,00000000), ref: 00ECCFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00ECC21E,00000000), ref: 00ECCFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00ECC21E,00000000), ref: 00ECCFF2

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 17059144685bdd1fe73a123c3c35aef40f573ba9f36d067db5b1aa1dac7835f7
Instruction ID: 0897cef9887a3981c0b5f2a25a847efb79ce15a0ec2ba002a3d1b5426affc1ec
Opcode Fuzzy Hash: 17059144685bdd1fe73a123c3c35aef40f573ba9f36d067db5b1aa1dac7835f7
Instruction Fuzzy Hash: C4318071A00249EFDB20DFA5D984EABBBF9EB04354B20542EF51AF6110D731ED46DB60

Function 00EB1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00EB1915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00EB19C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00EB19C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00EB19DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00EB19E2

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: ebb4d1ca19d76e2e7d955d020debdd68deacadf015c9415d2fd6f8c4a6d3b471
Instruction ID: de51674beddaed8e213db0dd08c095569382a381af32e81fd2452d7437b6fbee
Opcode Fuzzy Hash: ebb4d1ca19d76e2e7d955d020debdd68deacadf015c9415d2fd6f8c4a6d3b471
Instruction Fuzzy Hash: 4931C271900299EFCB04CFA8CDA9ADF3BB5EB45325F105265F921BB2D1C7709944CB91

Function 00EE5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00EE5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00EE579D
_wcslen.LIBCMT ref: 00EE57AF
_wcslen.LIBCMT ref: 00EE57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00EE5816

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 9bb718d553cc48d4680555bba5815770fed7435ec8d5d17cbd1c23052db2fd55
Instruction ID: 74ed3461afe51b54887213df03ac44ba1042b3500f0921fe45536b2981ab8c37
Opcode Fuzzy Hash: 9bb718d553cc48d4680555bba5815770fed7435ec8d5d17cbd1c23052db2fd55
Instruction Fuzzy Hash: B421937290469DDADB208F62CC84AEE77B8FF44728F109216F929FA1C1D7708985CF51

Function 00ED0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00ED0951
GetForegroundWindow.USER32 ref: 00ED0968
GetDC.USER32(00000000), ref: 00ED09A4
GetPixel.GDI32(00000000,?,00000003), ref: 00ED09B0
ReleaseDC.USER32(00000000,00000003), ref: 00ED09E8

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 79f9750b851ba0f486a00e452b57f4f4ba026f9f4f8c0fb13f97245a54e720e6
Instruction ID: 8492276b1ed5b6a5b0a9556d881632925b834e23df72fde2af68728730ca3518
Opcode Fuzzy Hash: 79f9750b851ba0f486a00e452b57f4f4ba026f9f4f8c0fb13f97245a54e720e6
Instruction Fuzzy Hash: D2216235600204AFD704EF65C994A9EB7E9EF84701F14846DF856E7352DB30AC05CB90

Function 00E8CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00E8CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00E8CDE9

Part of subcall function 00E83820: RtlAllocateHeap.NTDLL(00000000,?,00F21444,?,00E6FDF5,?,?,00E5A976,00000010,00F21440,00E513FC,?,00E513C6,?,00E51129), ref: 00E83852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00E8CE0F
_free.LIBCMT ref: 00E8CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00E8CE31

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: ff962ae601fbbce2c4b1a6fd8f97862b99f0fb34427f770ad4b9cffdeeeca560
Instruction ID: 21821ce4a9a7438a9d8aa2ccddf07392afb1e5aa61aa193963fce9a912d0b16a
Opcode Fuzzy Hash: ff962ae601fbbce2c4b1a6fd8f97862b99f0fb34427f770ad4b9cffdeeeca560
Instruction Fuzzy Hash: 650171726022557F232136B66C88D7B7A6DDBC7BA53355129F90DF6241EA718D0283B0

Function 00E69639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00E69693
SelectObject.GDI32(?,00000000), ref: 00E696A2
BeginPath.GDI32(?), ref: 00E696B9
SelectObject.GDI32(?,00000000), ref: 00E696E2

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 32b7a0c0642e46324c57c05d4961e17fed0d378d7dc7103b85d05283bde17956
Instruction ID: a1a4785e00bc9bedab4f80c6e1349c912514db6f4953fb19efd34bc4d73af24c
Opcode Fuzzy Hash: 32b7a0c0642e46324c57c05d4961e17fed0d378d7dc7103b85d05283bde17956
Instruction Fuzzy Hash: BD218070842349EFDB219F25EC447AD3BB8BB21399F100216F410B61B2D370589BEF99

Function 00EB5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00EB5726
_memcmp.LIBVCRUNTIME ref: 00EB5744
_memcmp.LIBVCRUNTIME ref: 00EB5757
_memcmp.LIBVCRUNTIME ref: 00EB576F
_memcmp.LIBVCRUNTIME ref: 00EB5787

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 8fb0d754841fbf05659978db9d0d097140d181764f208d0967e7b3d349644208
Instruction ID: 7f96a6482f169826fd6b677316188617766ac968a95de68dad3504ea8bf65232
Opcode Fuzzy Hash: 8fb0d754841fbf05659978db9d0d097140d181764f208d0967e7b3d349644208
Instruction Fuzzy Hash: AF01B973741719FBE20855159E42FFB739C9B2139CF206062FD08BA241FB60EE2182A4

Function 00E82DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00E7F2DE,00E83863,00F21444,?,00E6FDF5,?,?,00E5A976,00000010,00F21440,00E513FC,?,00E513C6), ref: 00E82DFD
_free.LIBCMT ref: 00E82E32
_free.LIBCMT ref: 00E82E59
SetLastError.KERNEL32(00000000,00E51129), ref: 00E82E66
SetLastError.KERNEL32(00000000,00E51129), ref: 00E82E6F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: a9b399df49eb87652f4ce78c2cf18704a9091626dcf68f147c2453620603c2b8
Instruction ID: 162f2e98842363ecbed7815ee1d5a1036197a3b5486470b72b8cf4d59c84d3bb
Opcode Fuzzy Hash: a9b399df49eb87652f4ce78c2cf18704a9091626dcf68f147c2453620603c2b8
Instruction Fuzzy Hash: 41012D322456047BC61337356C85D6B259DABC1775B31602CF62DB21E2EF34CC065324

Function 00EB000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00EAFF41,80070057,?,?,?,00EB035E), ref: 00EB002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00EAFF41,80070057,?,?), ref: 00EB0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00EAFF41,80070057,?,?), ref: 00EB0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00EAFF41,80070057,?), ref: 00EB0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00EAFF41,80070057,?,?), ref: 00EB0070

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 9fea42cdcec42a9488f2ccbac0938c7c2aaa0c0be1ce14cd1932afa7a2acb8d3
Instruction ID: 6b7588ac4be8e29ca4191f7e2d9ac57d05686ea791709716366d1c20bf3b2aa1
Opcode Fuzzy Hash: 9fea42cdcec42a9488f2ccbac0938c7c2aaa0c0be1ce14cd1932afa7a2acb8d3
Instruction Fuzzy Hash: 2901F272600208BFDB165F69DC44BEB7AEDEF44391F205424F901F6210D770ED059BA0

Function 00EB10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00EB1114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00EB0B9B,?,?,?), ref: 00EB1120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00EB0B9B,?,?,?), ref: 00EB112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00EB0B9B,?,?,?), ref: 00EB1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00EB114D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 865ffe2a938469df098f4faaeeabf57af0a6cd5d50a29473573028d1515c93ab
Instruction ID: 484707e259a62793213dedf6529b6bb470c01c12d80195c6ab42b7848ecab1dd
Opcode Fuzzy Hash: 865ffe2a938469df098f4faaeeabf57af0a6cd5d50a29473573028d1515c93ab
Instruction Fuzzy Hash: F1016D75101209BFDB114F69DC89AAB3B6EEF86364B200459FA41E7350DA31DC418A60

Function 00EB0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00EB0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00EB0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00EB0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00EB0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00EB1002

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: d847742ae17fb7e0013814fdf808812e0dfc754d8291529c3a2d2c9affa99b0b
Instruction ID: 26c56079401da2d10659a32efa5011c761da33014e61b6a9557a836fc52f75f3
Opcode Fuzzy Hash: d847742ae17fb7e0013814fdf808812e0dfc754d8291529c3a2d2c9affa99b0b
Instruction Fuzzy Hash: 78F0AF35100349AFD7211FA5AC8DF973B6EEF8A761F600458FD05EA250CA30DC418A60

Function 00EB1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00EB102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00EB1036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EB1045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00EB104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EB1062

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 6b006006c980159137f8f130b795481bde6865253079a9d2f49bf6a8513255f3
Instruction ID: fe21861ab6a1baf5473919f9dcc6f512fcc789ed46f7ef9fb80a989a64c76b90
Opcode Fuzzy Hash: 6b006006c980159137f8f130b795481bde6865253079a9d2f49bf6a8513255f3
Instruction Fuzzy Hash: 1EF0C235100345EFD7211FA5EC98F973B6DEF8A761F200414FD05EB250CA30D8419A60

Function 00EC030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00EC017D,?,00EC32FC,?,00000001,00E92592,?), ref: 00EC0324
CloseHandle.KERNEL32(?,?,?,?,00EC017D,?,00EC32FC,?,00000001,00E92592,?), ref: 00EC0331
CloseHandle.KERNEL32(?,?,?,?,00EC017D,?,00EC32FC,?,00000001,00E92592,?), ref: 00EC033E
CloseHandle.KERNEL32(?,?,?,?,00EC017D,?,00EC32FC,?,00000001,00E92592,?), ref: 00EC034B
CloseHandle.KERNEL32(?,?,?,?,00EC017D,?,00EC32FC,?,00000001,00E92592,?), ref: 00EC0358
CloseHandle.KERNEL32(?,?,?,?,00EC017D,?,00EC32FC,?,00000001,00E92592,?), ref: 00EC0365

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7677a1ac30db79aa6df2b369bc0ae74dc1cf58dd9b4f22046bb606efdb54bb3f
Instruction ID: ea9ecc59c529aa082c787fd3c02a89bc0192b6413df051fe42027a55106eb894
Opcode Fuzzy Hash: 7677a1ac30db79aa6df2b369bc0ae74dc1cf58dd9b4f22046bb606efdb54bb3f
Instruction Fuzzy Hash: 2501A272800B55DFCB309F6AD980916FBF9BF503193159A3FD19662931C372A95ACF80

Function 00E8D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E8D752

Part of subcall function 00E829C8: HeapFree.KERNEL32(00000000,00000000,?,00E8D7D1,00000000,00000000,00000000,00000000,?,00E8D7F8,00000000,00000007,00000000,?,00E8DBF5,00000000), ref: 00E829DE
Part of subcall function 00E829C8: GetLastError.KERNEL32(00000000,?,00E8D7D1,00000000,00000000,00000000,00000000,?,00E8D7F8,00000000,00000007,00000000,?,00E8DBF5,00000000,00000000), ref: 00E829F0

_free.LIBCMT ref: 00E8D764
_free.LIBCMT ref: 00E8D776
_free.LIBCMT ref: 00E8D788
_free.LIBCMT ref: 00E8D79A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 643da0f190faa87a61b4c33ec694aeb61b79cf167c82090c9410fade909ae6a8
Instruction ID: 247b8582086681b2e1b13488d03a954467b6809c45feea9fb370f65df190a4bc
Opcode Fuzzy Hash: 643da0f190faa87a61b4c33ec694aeb61b79cf167c82090c9410fade909ae6a8
Instruction Fuzzy Hash: 8BF01232588208AB8625FB68FDC5C567BEDBB44724796680AF14CF7541C735FC8087A4

Function 00EB5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00EB5C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00EB5C6F
MessageBeep.USER32(00000000), ref: 00EB5C87
KillTimer.USER32(?,0000040A), ref: 00EB5CA3
EndDialog.USER32(?,00000001), ref: 00EB5CBD

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: f3793cd11f8379bb93d7d897bfeb569f9f474e346edca22bc9bb4a915e3cf6db
Instruction ID: 63395b9a7fdb5d552fa10194226ce0ea632c32addf58c215c427f38555e4c933
Opcode Fuzzy Hash: f3793cd11f8379bb93d7d897bfeb569f9f474e346edca22bc9bb4a915e3cf6db
Instruction Fuzzy Hash: 9A018631500B48AFEB215B11DD8EFE7BBB9BB00B05F041559B587B50E1DBF0A9898E90

Function 00E822A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E822BE

Part of subcall function 00E829C8: HeapFree.KERNEL32(00000000,00000000,?,00E8D7D1,00000000,00000000,00000000,00000000,?,00E8D7F8,00000000,00000007,00000000,?,00E8DBF5,00000000), ref: 00E829DE
Part of subcall function 00E829C8: GetLastError.KERNEL32(00000000,?,00E8D7D1,00000000,00000000,00000000,00000000,?,00E8D7F8,00000000,00000007,00000000,?,00E8DBF5,00000000,00000000), ref: 00E829F0

_free.LIBCMT ref: 00E822D0
_free.LIBCMT ref: 00E822E3
_free.LIBCMT ref: 00E822F4
_free.LIBCMT ref: 00E82305

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: eef072a245f42cb928ccff8386001d9d56b5a832d6d9d3e1807b7431584a970f
Instruction ID: 5109971ae70ffe283dc65f9762a497169a38475ee2c3c735cada314a9e6dd166
Opcode Fuzzy Hash: eef072a245f42cb928ccff8386001d9d56b5a832d6d9d3e1807b7431584a970f
Instruction Fuzzy Hash: 2FF05E718801288B8632BF54BC418493BA4F768760702250EF51CE22B2CB341853BFE8

Function 00E695C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00E695D4
StrokeAndFillPath.GDI32(?,?,00EA71F7,00000000,?,?,?), ref: 00E695F0
SelectObject.GDI32(?,00000000), ref: 00E69603
DeleteObject.GDI32 ref: 00E69616
StrokePath.GDI32(?), ref: 00E69631

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 150f9d9c118214bffda25a10f34fcda8b8c84020190fe5526779c466c7e8ca7f
Instruction ID: 59890993bce9078863f253d9d642ea5743359dccb99bb2b6b9bc871f23bb3a28
Opcode Fuzzy Hash: 150f9d9c118214bffda25a10f34fcda8b8c84020190fe5526779c466c7e8ca7f
Instruction Fuzzy Hash: C3F0193004638CEFDB265F66ED58B683B65BB11366F149214F425690F1C730899BEF28

Function 00E80F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00E810F9
__freea.LIBCMT ref: 00E81117

Part of subcall function 00E81537: _free.LIBCMT ref: 00E8154F

Strings

am/pm, xrefs: 00E8117A
a/p, xrefs: 00E811DE

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 8aa8f7ee11109f728016ada44bbf8f5dd03f8ba88f34e54318ffe5130e986977
Instruction ID: 788bd75a5fcc3f228628e40bbae732740031198bb5e02c90f5c0510be2bf65f3
Opcode Fuzzy Hash: 8aa8f7ee11109f728016ada44bbf8f5dd03f8ba88f34e54318ffe5130e986977
Instruction Fuzzy Hash: DBD10331900246CACB24BF68C849BFAB7B9FF06704F256199E90DBB650D3759D82CB91

Function 00E85AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JO, xrefs: 00E85BA8, 00E85C6C

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID: JO
API String ID: 0-1663374661
Opcode ID: 3075e0e7b5686e7d78cd7cc1a65f9036f659364ad9649da750fd587136dd9631
Instruction ID: be4c853c67db0ce22d435515378af9a064a4eb5da295c6b3112df8cbad70e236
Opcode Fuzzy Hash: 3075e0e7b5686e7d78cd7cc1a65f9036f659364ad9649da750fd587136dd9631
Instruction Fuzzy Hash: C151BD76D00A099FCB21BFA4CD45BEEBBF8AF45314F14205AF40DB72A2DA319901DB61

Function 00E88A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00E88B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00E88B7A
__dosmaperr.LIBCMT ref: 00E88B81

Strings

., xrefs: 00E88A63

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .
API String ID: 2434981716-3963672497
Opcode ID: 68d3b277a3df78d70822c3118b7dd4146f10214747a6977182852796cd8e8a14
Instruction ID: 22d928b695f878037c5c58319225382df96c3b76c73ea5f33811a530c5f215c7
Opcode Fuzzy Hash: 68d3b277a3df78d70822c3118b7dd4146f10214747a6977182852796cd8e8a14
Instruction Fuzzy Hash: 82416E75604085AFD734AF64CA80ABD7FE6DFC5304B2891AAFC8DA7553DE318C029790

Function 00EB2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00EB21D0,?,?,00000034,00000800,?,00000034), ref: 00EBB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00EB2760

Part of subcall function 00EBB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00EB21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00EBB3F8

Part of subcall function 00EBB32A: GetWindowThreadProcessId.USER32(?,?), ref: 00EBB355
Part of subcall function 00EBB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00EB2194,00000034,?,?,00001004,00000000,00000000), ref: 00EBB365
Part of subcall function 00EBB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00EB2194,00000034,?,?,00001004,00000000,00000000), ref: 00EBB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00EB27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00EB281A

Strings

@, xrefs: 00EB2832

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 31c6588e49614dd8ad1a98ff70a79fc75142935d4bed97848c50954d21b36e57
Instruction ID: 774c7de46244e131a9ee6273a899964d5f5ee41e5d8403ef33f5869ca12ecc34
Opcode Fuzzy Hash: 31c6588e49614dd8ad1a98ff70a79fc75142935d4bed97848c50954d21b36e57
Instruction Fuzzy Hash: EF412D72900218AFDB10DFA4CD85AEFBBB8EF09700F105099FA55B7181DBB06E45CBA1

Function 00E8172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00E81769
_free.LIBCMT ref: 00E81834
_free.LIBCMT ref: 00E8183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00E81760, 00E81767, 00E81796, 00E817CE

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-517116171
Opcode ID: 8346edeba63e2f7ad9bf61a4e112e83b5ed66443d2b86ccbfa7f1fbb08664d1d
Instruction ID: ed82655fadf15ce341e2a59242fb3b648b7e72ff373f208c0982ccca4e7459a6
Opcode Fuzzy Hash: 8346edeba63e2f7ad9bf61a4e112e83b5ed66443d2b86ccbfa7f1fbb08664d1d
Instruction Fuzzy Hash: D5319271A00258EFDB25EF99D881D9EBBFCEB95310F1051AAF80CE7211D6708E42DB90

Function 00EBC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00EBC306
DeleteMenu.USER32(?,00000007,00000000), ref: 00EBC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00F21990,010E6548), ref: 00EBC395

Strings

0, xrefs: 00EBC2DF

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 4a280e4a5e72923ff150709b8306a908711a8a237f8889c180999c7ba4e2cf2e
Instruction ID: 56f449aeb8b4baf12dd80fa97cd6c6acf0145898e7cd375146abb83bec37da41
Opcode Fuzzy Hash: 4a280e4a5e72923ff150709b8306a908711a8a237f8889c180999c7ba4e2cf2e
Instruction Fuzzy Hash: 8141B2312083419FD720DF25D884F9BBBE4AF85314F249A6EF9A5A72D1D770E904CB62

Function 00EE4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00EECC08,00000000,?,?,?,?), ref: 00EE44AA
GetWindowLongW.USER32 ref: 00EE44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00EE44D7

Strings

SysTreeView32, xrefs: 00EE447C

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 827819b82c1ac545eb1451b6c12ee80a0c822f7dc18381d9f1db28e50cd741dd
Instruction ID: 6cf6932fd7ccc4267e0ff2d8191c3b09c640ec91f38215db8db23fd850bec925
Opcode Fuzzy Hash: 827819b82c1ac545eb1451b6c12ee80a0c822f7dc18381d9f1db28e50cd741dd
Instruction Fuzzy Hash: C831AD71200289AFDB219E39DC45BEB77A9EB08338F205725F979A31D0D770EC559750

Function 00EB6E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00EB6EED
VariantCopyInd.OLEAUT32(?,?), ref: 00EB6F08
VariantClear.OLEAUT32(?), ref: 00EB6F12

Strings

*j, xrefs: 00EB6E8B, 00EB6E90, 00EB6EF8

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *j
API String ID: 2173805711-1845181700
Opcode ID: b3f556e1c4876d9b717bf13c9d15c86c1dfcdbe89a6a6cbc57e840b84b4dcc3b
Instruction ID: 3156678d1e9f7e124c0f3d59c18f34585123af06dde7b77664fb96e6ab90286b
Opcode Fuzzy Hash: b3f556e1c4876d9b717bf13c9d15c86c1dfcdbe89a6a6cbc57e840b84b4dcc3b
Instruction Fuzzy Hash: 0931A271704245DFCB06AFA4E8919FF37B6FF85305B1018A8F9126B2A1D7389916DBE0

Function 00ED304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00ED3077,?,?), ref: 00ED3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00ED307A
_wcslen.LIBCMT ref: 00ED309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00ED3106

Strings

255.255.255.255, xrefs: 00ED3095, 00ED309A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 13c1e54b005240bca7a76b297bc07efdc66c5f2af25e061d5f14a1ca3a92f196
Instruction ID: 39645353a530e092613679d5ffe689e15555893b1024047d0e786e2a6623d712
Opcode Fuzzy Hash: 13c1e54b005240bca7a76b297bc07efdc66c5f2af25e061d5f14a1ca3a92f196
Instruction Fuzzy Hash: 1031D539200206DFC720CF78C585EAA77E0EF54318F24905AE915AB393D772EE46C762

Function 00EE3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00EE3F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00EE3F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00EE3F78

Strings

SysMonthCal32, xrefs: 00EE3F0B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 16a1c1e3edaaaac9486d0b00bfb963fbbc08c76777554d90af4c72ac5a5bdc38
Instruction ID: 4251fabad151bd8d061ca2f7249217257f314573ad575918dc0c1a2790066815
Opcode Fuzzy Hash: 16a1c1e3edaaaac9486d0b00bfb963fbbc08c76777554d90af4c72ac5a5bdc38
Instruction Fuzzy Hash: 7421AD32600259BFDF218FA1CC86FEA3BB6EF48718F111214FA157B1D0D6B1A955DB90

Function 00EE4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00EE4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00EE4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00EE471A

Strings

msctls_updown32, xrefs: 00EE4684

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 83cf8ecb3546f2cf4463747b75d043a761e8100cc6c25dc713b47efebdec2b22
Instruction ID: 395bb7872d9a6c2a46084ae9ea4c894106a6abf519976f47b1e6038f43f4e564
Opcode Fuzzy Hash: 83cf8ecb3546f2cf4463747b75d043a761e8100cc6c25dc713b47efebdec2b22
Instruction Fuzzy Hash: 592192F5600249AFEB10DF65DCC1DA737EDEB5A358B141059FA00AB391C770EC52DAA0

Function 00EB95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EB961D

Strings

#notrayicon, xrefs: 00EB95B7
#OnAutoItStartRegister, xrefs: 00EB95F3
#requireadmin, xrefs: 00EB95D9

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: a3c685199e08449dd343a4a0af662cf48278065412ca0e4a14f2e14856233b0c
Instruction ID: 8b09b0160e839de2a697fda7ded3bd0fd168d96ff0699ea7d215df9e1b14bf32
Opcode Fuzzy Hash: a3c685199e08449dd343a4a0af662cf48278065412ca0e4a14f2e14856233b0c
Instruction Fuzzy Hash: B8216D7214421566C331AB25EC06FFB73D8DFA1314F10A426FB89B7087EB919D55C2E5

Function 00EE37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00EE3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00EE3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00EE3876

Strings

Listbox, xrefs: 00EE380F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 7bfcb1d694c25f86829f8c4fdfa33ddd8c62a24641e19fb7fb42b70df2271886
Instruction ID: fb8ef1eb3dcb026428a4d4295dd7ebc553ce852fea0f8b6c2c76be332350fb8a
Opcode Fuzzy Hash: 7bfcb1d694c25f86829f8c4fdfa33ddd8c62a24641e19fb7fb42b70df2271886
Instruction Fuzzy Hash: 4021B07261025CBBEF218F66DC85EAB376AEF89754F109125F904AB190C671DC5287A0

Function 00EC49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00EC4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00EC4A5C
SetErrorMode.KERNEL32(00000000,?,?,00EECC08), ref: 00EC4AD0

Strings

%lu, xrefs: 00EC4A6F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 8d3631ca0f3583ad6973a31f62e74d9339da31cc78dbed7fedef553d0d9a2c9a
Instruction ID: bfb55c283b73bf598da7a278a2d348b60a1fe2a8b6c2b868e87e823cb3508a5e
Opcode Fuzzy Hash: 8d3631ca0f3583ad6973a31f62e74d9339da31cc78dbed7fedef553d0d9a2c9a
Instruction Fuzzy Hash: F0317371A00209AFDB10DF54C985EAAB7F8EF09308F145499F905EF252D771ED46CB61

Function 00EE41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00EE424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00EE4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00EE4271

Strings

msctls_trackbar32, xrefs: 00EE4226

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: c141365384bedee7518200ef27d58fd7f1f0d74a289bd4148239c18e458cea77
Instruction ID: d87c6e83df773db72d935db12df88af3eea2eaf6d545002f5dfd19e66268dc76
Opcode Fuzzy Hash: c141365384bedee7518200ef27d58fd7f1f0d74a289bd4148239c18e458cea77
Instruction Fuzzy Hash: 7411A37124028CBEEF205E6ACC46FAB3BACEF99B68F111524FA55F60E0D671D8519B10

Function 00EB2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E56B57: _wcslen.LIBCMT ref: 00E56B6A

Part of subcall function 00EB2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00EB2DC5
Part of subcall function 00EB2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EB2DD6
Part of subcall function 00EB2DA7: GetCurrentThreadId.KERNEL32 ref: 00EB2DDD
Part of subcall function 00EB2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00EB2DE4

GetFocus.USER32 ref: 00EB2F78

Part of subcall function 00EB2DEE: GetParent.USER32(00000000), ref: 00EB2DF9

GetClassNameW.USER32(?,?,00000100), ref: 00EB2FC3
EnumChildWindows.USER32(?,00EB303B), ref: 00EB2FEB

Strings

%s%d, xrefs: 00EB2FFF

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: f63db5a0762a980d938d088c7cec1af56346db232ea8c33f3fb7868a1d1443b4
Instruction ID: 916938f612fbdb788290d9b6c120cf07acbd78721375ff192fa3993aea12af52
Opcode Fuzzy Hash: f63db5a0762a980d938d088c7cec1af56346db232ea8c33f3fb7868a1d1443b4
Instruction Fuzzy Hash: 5411B4716002096BCF547F709CC6EEF77AAAF94304F146079FE09BB252DE70994A9B60

Function 00EE5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00EE58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00EE58EE
DrawMenuBar.USER32(?), ref: 00EE58FD

Strings

0, xrefs: 00EE588F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 5cb27189c78e068a3e02b3ef313ab6add0174e5e8a021d81aafe5fd172f447dc
Instruction ID: 3178a24b4b0d53fbc67f103661ce1c570cda07fe60c8db5aafa640a5fb90798b
Opcode Fuzzy Hash: 5cb27189c78e068a3e02b3ef313ab6add0174e5e8a021d81aafe5fd172f447dc
Instruction Fuzzy Hash: 4901613250029CEFDB219F12EC44BEEBBB4FB45368F108099F959EA151DB318A94DF21

Function 00EAD3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00EAD3BF
FreeLibrary.KERNEL32 ref: 00EAD3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00EAD3B9
X64, xrefs: 00EAD2A8

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 624e3adfc99a066ef763e58d0712d46bc1dc6ebdfa4c3722e46e4da06384dab9
Instruction ID: cec93e40fd90fd48ac9d3111ac1e3f67ce3f320d31ae3c836dd863368527ae99
Opcode Fuzzy Hash: 624e3adfc99a066ef763e58d0712d46bc1dc6ebdfa4c3722e46e4da06384dab9
Instruction Fuzzy Hash: E6F0552180E6658BDB3152124C54AE93330BF2A741BA87568F403FD829D720EC4CC2A2

Function 00EB007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f81e49473fa7279b0876ed7d82cd924ba1ce6f17a426374b8229662c79f8e02d
Instruction ID: be05dd231944659cb164a96d4142d376621407388da4cfdbc2e66b9f68926b65
Opcode Fuzzy Hash: f81e49473fa7279b0876ed7d82cd924ba1ce6f17a426374b8229662c79f8e02d
Instruction Fuzzy Hash: 8AC13C75A0021AEFDB14CFA8C898AAFB7B5FF48714F209598E505EB251D731ED41CB90

Function 00ED342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00ED3459
CoUninitialize.OLE32 ref: 00ED3463
VariantInit.OLEAUT32(?), ref: 00ED346E
VariantClear.OLEAUT32(?), ref: 00ED371B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: e37bfa33fc00077b0f379e855a28e671af82d0ce50f3d66db5b4c79cccadc3f4
Instruction ID: 268b05575df6bd5e252db6c62108b62cf0223d5a94e2b36a644cb278ebc56b8b
Opcode Fuzzy Hash: e37bfa33fc00077b0f379e855a28e671af82d0ce50f3d66db5b4c79cccadc3f4
Instruction Fuzzy Hash: 2BA15B752043009FC700DF28D485A6AB7E5FF88715F14985AF99AAB362DB30EE06CB52

Function 00EB0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00EEFC08,?), ref: 00EB05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00EEFC08,?), ref: 00EB0608
CLSIDFromProgID.OLE32(?,?,00000000,00EECC40,000000FF,?,00000000,00000800,00000000,?,00EEFC08,?), ref: 00EB062D
_memcmp.LIBVCRUNTIME ref: 00EB064E

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: b21b5f92d64b74bdd049e1cea289cdb790f49bacaa31d6bf7f92e0a36becf165
Instruction ID: 197220e7269fae810bebee9d041ea5c2877d7f39940b36751246689ddd78ac3c
Opcode Fuzzy Hash: b21b5f92d64b74bdd049e1cea289cdb790f49bacaa31d6bf7f92e0a36becf165
Instruction Fuzzy Hash: 2181E771A00209EFCB14DF98C984EEFB7B9FF89315B205558E516BB250DB71AE06CB60

Function 00E91391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E914C0

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8bf3ed92b091cb8b9e250373c9d8377a9fb360d047b9767936dbbbc7ec3283a2
Instruction ID: 6e2f7185dee9ef09a32ba5bdf6d4927c01844f9b8c1376c2f1bd59d2fce3007a
Opcode Fuzzy Hash: 8bf3ed92b091cb8b9e250373c9d8377a9fb360d047b9767936dbbbc7ec3283a2
Instruction Fuzzy Hash: B0415B31A00102ABDF257BF98C856BE3AE5EF49370F2562A5F43DF6292E63488415762

Function 00EE6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00EE62E2
ScreenToClient.USER32(?,?), ref: 00EE6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00EE6382

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: c7fba6ae777247d158496d9d5c8614a21af7233134bdca8bae40f64ef68ababf
Instruction ID: d764d946940245f05a0c32f53e24c4f54e7a66e5e4b2a59cf6d141f4d5bb6f26
Opcode Fuzzy Hash: c7fba6ae777247d158496d9d5c8614a21af7233134bdca8bae40f64ef68ababf
Instruction Fuzzy Hash: A5514E74900249EFDF10DF65D8809AE7BB6FFA53A4F109159F915AB2A0D730ED81CB50

Function 00ED1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00ED1AFD
WSAGetLastError.WSOCK32 ref: 00ED1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00ED1B8A
WSAGetLastError.WSOCK32 ref: 00ED1B94

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 7bf4894a71cf9fcef9f62886780ee3015491b4a9cfe9354c46d308923e252b43
Instruction ID: 8d38e85ec948bddf2b656c23e9873ccd7f90d46c4820f732a8ddeb1a8d67d26d
Opcode Fuzzy Hash: 7bf4894a71cf9fcef9f62886780ee3015491b4a9cfe9354c46d308923e252b43
Instruction Fuzzy Hash: B541B234640200AFE720AF24D886F2677E5EB44718F54A489F95AAF3D2D772ED46CB90

Function 00E8B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2887aa8bf235b1d7ebaa888b11ff5d7d4c62b0e1ccf1a7c5799f5079a3064d2d
Instruction ID: ef00a89b055de63c7d69885a1c5b85a39d4c6f48a5bc18c2ae49a5f890a7eac7
Opcode Fuzzy Hash: 2887aa8bf235b1d7ebaa888b11ff5d7d4c62b0e1ccf1a7c5799f5079a3064d2d
Instruction Fuzzy Hash: D5411B75A00704BFD724AF38CC42BAA7BE9EB84710F10556EF55EFB292E77199018790

Function 00EC56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00EC5783
GetLastError.KERNEL32(?,00000000), ref: 00EC57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00EC57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00EC57FA

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: c6f20399ccab760f5a9526f42b091b9e7fed3f9928f8afdcd58a47f8a4773a3f
Instruction ID: 8553822593750655d474620f6b3b99ccbe2b4518ffde8a26948d634db4360b8a
Opcode Fuzzy Hash: c6f20399ccab760f5a9526f42b091b9e7fed3f9928f8afdcd58a47f8a4773a3f
Instruction Fuzzy Hash: 2A413C36600610DFCB10DF15C544A5EBBE2AF89321B199888FC8A7B362DB31FD45CB91

Function 00E8D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00E782D9,?,00E782D9,?,00000001,?,?,00000001,00E782D9,00E782D9), ref: 00E8D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00E8D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00E8D9AB
__freea.LIBCMT ref: 00E8D9B4

Part of subcall function 00E83820: RtlAllocateHeap.NTDLL(00000000,?,00F21444,?,00E6FDF5,?,?,00E5A976,00000010,00F21440,00E513FC,?,00E513C6,?,00E51129), ref: 00E83852

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 68987fd6639f4bf0bc2c9bf93ddf1ff3f0b69a0fed52615756a7dc2c88fbc814
Instruction ID: 8c6e935542dc4f13232b7ced1d8c224fd5eee76fc54f10e7538fc39ba8c3bde1
Opcode Fuzzy Hash: 68987fd6639f4bf0bc2c9bf93ddf1ff3f0b69a0fed52615756a7dc2c88fbc814
Instruction Fuzzy Hash: 1831D272A0021AABDF24EF65DC41EAE7BA5EB80714F154168FC0CE7190E775CD55CB90

Function 00EE52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00EE5352
GetWindowLongW.USER32(?,000000F0), ref: 00EE5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00EE5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00EE53A8

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 43ff573124af6d63aae6cee9f22de19368daa3f2ad6f9a94190678027ef20f08
Instruction ID: 1bd530e0b950c34c910360fd91199751b64e53d6b567a0a086d2e53387c9ecce
Opcode Fuzzy Hash: 43ff573124af6d63aae6cee9f22de19368daa3f2ad6f9a94190678027ef20f08
Instruction Fuzzy Hash: 74312836A55A8CEFEB309F16CC45FE93761AB0539CF686001FA10B62E5C3B09D40DB41

Function 00EBAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00EBABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00EBAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00EBAC74
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00EBACC6

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d33d096469abf384f028e1527641d386b2bbe845154a7318eaf9138a032adc68
Instruction ID: d58a73dbebbe667df48b034af15acda05aa9c7fbeaac7d870375ee3b95c678b0
Opcode Fuzzy Hash: d33d096469abf384f028e1527641d386b2bbe845154a7318eaf9138a032adc68
Instruction Fuzzy Hash: BC311630A00258AFEF35CB6588457FBBFA5AB89314F1C622AE481761D1D37489858BA2

Function 00EE7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00EE769A
GetWindowRect.USER32(?,?), ref: 00EE7710
PtInRect.USER32(?,?,00EE8B89), ref: 00EE7720
MessageBeep.USER32(00000000), ref: 00EE778C

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 783b81850b9876d8208e86674230c405f6d8b0b0fa42acbcb26f582c3b53a4bd
Instruction ID: 7c6c8afa6ea578e730bac9a15304a05ee46246b6d61bc3c2d6235a5723c96f1f
Opcode Fuzzy Hash: 783b81850b9876d8208e86674230c405f6d8b0b0fa42acbcb26f582c3b53a4bd
Instruction Fuzzy Hash: 5741BF3460929DDFDB11CF5AD894EA977F4FF49309F1550AAE894AB261C330E982CF90

Function 00EE16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00EE16EB

Part of subcall function 00EB3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00EB3A57
Part of subcall function 00EB3A3D: GetCurrentThreadId.KERNEL32 ref: 00EB3A5E
Part of subcall function 00EB3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00EB25B3), ref: 00EB3A65

GetCaretPos.USER32(?), ref: 00EE16FF
ClientToScreen.USER32(00000000,?), ref: 00EE174C
GetForegroundWindow.USER32 ref: 00EE1752

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 8b80644724697b2b2905447279ec53124244fb628a4f417b74e4fb5b6f2095dc
Instruction ID: 6dedcc575d86b846911533e28d9a436c6fca56ee5216767ffda03f665a38529e
Opcode Fuzzy Hash: 8b80644724697b2b2905447279ec53124244fb628a4f417b74e4fb5b6f2095dc
Instruction Fuzzy Hash: 53314371D00249AFC700DFA6C881CEEBBF9EF49304B5454AAE415F7251D7319E45CBA0

Function 00EBDF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00E57620: _wcslen.LIBCMT ref: 00E57625

_wcslen.LIBCMT ref: 00EBDFCB
_wcslen.LIBCMT ref: 00EBDFE2
_wcslen.LIBCMT ref: 00EBE00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00EBE018

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 32fd0f3218e909aa956d089b7a4923fc807a325b6373e4101a9e68cce97a5b7c
Instruction ID: d1991a8fc36f8934c7907a4da3ce30fbfcf2f397ed2a01d027769339fe4acc60
Opcode Fuzzy Hash: 32fd0f3218e909aa956d089b7a4923fc807a325b6373e4101a9e68cce97a5b7c
Instruction Fuzzy Hash: 5721A171900215AFCB20EFA8D982BBEB7F8EF85750F145065E905BB385D7709E418BA1

Function 00EBD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00EBD501
Process32FirstW.KERNEL32(00000000,?), ref: 00EBD50F
Process32NextW.KERNEL32(00000000,?), ref: 00EBD52F
CloseHandle.KERNEL32(00000000), ref: 00EBD5DC

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ade67ea693c0b9af2ce4cd72711213e997da8d600ca6f239311232e0620f179c
Instruction ID: d9d395f3d2ad4e8138c074e43f5ff7e29cbd8eee3c01990123adbfe50508b170
Opcode Fuzzy Hash: ade67ea693c0b9af2ce4cd72711213e997da8d600ca6f239311232e0620f179c
Instruction Fuzzy Hash: 3E31AD310083409FD314EF54DC81AAFBBF8EF99344F14092DF981A71A2EB719949CBA2

Function 00EE8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E69BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E69BB2

GetCursorPos.USER32(?), ref: 00EE9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00EA7711,?,?,?,?,?), ref: 00EE9016
GetCursorPos.USER32(?), ref: 00EE905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00EA7711,?,?,?), ref: 00EE9094

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 0049ad3cb0b86b6dea5bbb5e0eb4632885cf4d1c807770c4a49181e2e8e5e507
Instruction ID: 22a0d7b29a72af17e7dc65b2befc12cda732b4517ab59a6038c106d090662999
Opcode Fuzzy Hash: 0049ad3cb0b86b6dea5bbb5e0eb4632885cf4d1c807770c4a49181e2e8e5e507
Instruction Fuzzy Hash: C621E13120005CEFDB258F96C898EEA3BF9FB89350F500055F5056B162C3759A91EB60

Function 00EBD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00EECB68), ref: 00EBD2FB
GetLastError.KERNEL32 ref: 00EBD30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00EBD319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00EECB68), ref: 00EBD376

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 382db26bf3038096680d50e1a786f13ffa44682fa327b623078e660d32545371
Instruction ID: f68c980c7347443444afc77098ec2f964aa92e6fb25954349f917fd9e5d24100
Opcode Fuzzy Hash: 382db26bf3038096680d50e1a786f13ffa44682fa327b623078e660d32545371
Instruction Fuzzy Hash: 3C2180705083019F8300DF28D8814AF77E4AF59368F205A1DF899E72A2E731994ACB93

Function 00EB1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00EB102A
Part of subcall function 00EB1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00EB1036
Part of subcall function 00EB1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EB1045
Part of subcall function 00EB1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00EB104C
Part of subcall function 00EB1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00EB1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00EB15BE
_memcmp.LIBVCRUNTIME ref: 00EB15E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00EB1617
HeapFree.KERNEL32(00000000), ref: 00EB161E

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 997efc02ea3fb7c75a5d470e26c1c698ef53c30c0439bf1ecbcdf82d7864e4be
Instruction ID: 5c68887404993b586136521051eb14d19b5002862a82e468b1e85f4f6d1e45cf
Opcode Fuzzy Hash: 997efc02ea3fb7c75a5d470e26c1c698ef53c30c0439bf1ecbcdf82d7864e4be
Instruction Fuzzy Hash: 50217A31E01208EFDB10DFA4C955BEFB7B8EF44368F5854A9E441BB241E730AA45CBA0

Function 00EE2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00EE280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00EE2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00EE2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00EE2840

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 99bff1fdf7ef8f880249e0e4f193596458aac1e556771f2bb5fad8cf691469a9
Instruction ID: 11685ecbe20c8e5eb4c8e29f4d6b9592fd6880b204cfdf63c03fab3577852c35
Opcode Fuzzy Hash: 99bff1fdf7ef8f880249e0e4f193596458aac1e556771f2bb5fad8cf691469a9
Instruction Fuzzy Hash: 64213631204198AFD7149F25CC41FAA7799EF45324F24911CF916AB2D2C771FC46C790

Function 00EB78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00EB790A,?,000000FF,?,00EB8754,00000000,?,0000001C,?,?), ref: 00EB8D8C
Part of subcall function 00EB8D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00EB8DB2
Part of subcall function 00EB8D7D: lstrcmpiW.KERNEL32(00000000,?,00EB790A,?,000000FF,?,00EB8754,00000000,?,0000001C,?,?), ref: 00EB8DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00EB8754,00000000,?,0000001C,?,?,00000000), ref: 00EB7923
lstrcpyW.KERNEL32(00000000,?), ref: 00EB7949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00EB8754,00000000,?,0000001C,?,?,00000000), ref: 00EB7984

Strings

cdecl, xrefs: 00EB797B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 41028eabae4ec5cc91f28b2a45c1b7508bdb89deb9292e6543f554b5b004a92d
Instruction ID: 7e696483b2bd784ed06412656f35c675ca52141b59ed4d58626352f91fcc5ce5
Opcode Fuzzy Hash: 41028eabae4ec5cc91f28b2a45c1b7508bdb89deb9292e6543f554b5b004a92d
Instruction Fuzzy Hash: 8E11E43A201241AFCB159F35D844DBB77E9FFC5394B10502AF982DB264EB319811C791

Function 00EE7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00EE7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00EE7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00EE7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00ECB7AD,00000000), ref: 00EE7D6B

Part of subcall function 00E69BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E69BB2

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 22ece74fb08861eebe964508356234e15e6598bfcfd355c2ec8b2b9edd1571f2
Instruction ID: 15459fb45a482a7e411f9980e20aea0cd0780d156503b1923d0fd877c87b881d
Opcode Fuzzy Hash: 22ece74fb08861eebe964508356234e15e6598bfcfd355c2ec8b2b9edd1571f2
Instruction Fuzzy Hash: 2611AE3120469DAFCB108F2ADC44AB63BA4BF46364B255324F875EB2E0E7308951DB40

Function 00EE5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00EE56BB
_wcslen.LIBCMT ref: 00EE56CD
_wcslen.LIBCMT ref: 00EE56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00EE5816

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: eafa5a039ef404038d30e7dd2979b7e00fddbb7cd1faaa5db0bd8c515e66631e
Instruction ID: e0f4214f6f25e66723fb0de6fc2e73afd56a660428326223b1ace0f4864a98bf
Opcode Fuzzy Hash: eafa5a039ef404038d30e7dd2979b7e00fddbb7cd1faaa5db0bd8c515e66631e
Instruction Fuzzy Hash: D211B47260069E96DB209F628C85AEE77ACEF5076CF105026F916F6081E770C984CB65

Function 00E81D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2bde89f328ab5615300f5191ae1e7fb7dc31c720767eb868c180835e2efcee
Instruction ID: 8b502da1922f8055e7cd7bfa44ba62c303a4a6eb3bfb4051a5bc54c224aed9fd
Opcode Fuzzy Hash: 6e2bde89f328ab5615300f5191ae1e7fb7dc31c720767eb868c180835e2efcee
Instruction Fuzzy Hash: A701ADB220A61A7EF62136786CC0F67666CDF813B9B312769F62DB11D2DB608C025360

Function 00EB1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00EB1A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00EB1A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00EB1A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00EB1A8A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1898de04b4b2d3d43a0e68bd44280583f26cfb96daa5071657c2b80b838cbca0
Instruction ID: 7112b2ddbc07ba2d7873e5fec90c8bd60eb46692b9efd24bb83dc8dba6cc9c5f
Opcode Fuzzy Hash: 1898de04b4b2d3d43a0e68bd44280583f26cfb96daa5071657c2b80b838cbca0
Instruction Fuzzy Hash: A311273A901219FFEB109BA5C985FEEBB78EB08760F200091EA00B7290D6716E50DB94

Function 00EBE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00EBE1FD
MessageBoxW.USER32(?,?,?,?), ref: 00EBE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00EBE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00EBE24D

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: c6f4ff1269990d62d0feb7b9e742dc4a93b5780da16f792eb1b0c78d2593551b
Instruction ID: 18db313e1d9ae98ea1c241aa39818032b34320b50a64f4c885f93936798d494d
Opcode Fuzzy Hash: c6f4ff1269990d62d0feb7b9e742dc4a93b5780da16f792eb1b0c78d2593551b
Instruction Fuzzy Hash: 16110472904258BFC711DBA8AC49ADF7FADAB45324F104259F825F33A1D6B0DD0587A0

Function 00E7D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00E7CFF9,00000000,00000004,00000000), ref: 00E7D218
GetLastError.KERNEL32 ref: 00E7D224
__dosmaperr.LIBCMT ref: 00E7D22B
ResumeThread.KERNEL32(00000000), ref: 00E7D249

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 1a27103841b113bcc7c77b7d95b9f1498b21d7f0308093b40e6c7ae8efe099a5
Instruction ID: 526c23e933da0c5d31eac5ddddb508904191ba23133bfc4f6c8e36065f061ba9
Opcode Fuzzy Hash: 1a27103841b113bcc7c77b7d95b9f1498b21d7f0308093b40e6c7ae8efe099a5
Instruction Fuzzy Hash: 53012636409248BBC7115BA6DC05BAA3ABDDF81730F209219F92CB60E1CB708902C6A0

Function 00EE9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00E69BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00E69BB2

GetClientRect.USER32(?,?), ref: 00EE9F31
GetCursorPos.USER32(?), ref: 00EE9F3B
ScreenToClient.USER32(?,?), ref: 00EE9F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00EE9F7A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: a1a5f530aa2b028ac902785d69828c0f4b7507f8e075035cebeacc1d867d10a1
Instruction ID: 47c943dc255e6b20cab9dd3631710ee7caff0028faedc614dd7010297ef7b1f0
Opcode Fuzzy Hash: a1a5f530aa2b028ac902785d69828c0f4b7507f8e075035cebeacc1d867d10a1
Instruction Fuzzy Hash: 7E113672A0029EABDB10DF6AE8899FE77B9FB05311F100451F911F7142D330BA86CBA1

Function 00E5600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00E5604C
GetStockObject.GDI32(00000011), ref: 00E56060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00E5606A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: e88440e266bb16a52c20d83aad743cea8d02654d2e07f87ae16136aa4dac3184
Instruction ID: 81e0c663181f17be9b2307ef6f7b4465000f49c68315ad831d701731158de29e
Opcode Fuzzy Hash: e88440e266bb16a52c20d83aad743cea8d02654d2e07f87ae16136aa4dac3184
Instruction Fuzzy Hash: D6118E72101549BFEF224FA4CC44EEA7B69EF08365F501202FE0466150C732DC659B90

Function 00E73B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00E73B56

Part of subcall function 00E73AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00E73AD2
Part of subcall function 00E73AA3: ___AdjustPointer.LIBCMT ref: 00E73AED

_UnwindNestedFrames.LIBCMT ref: 00E73B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00E73B7C
CallCatchBlock.LIBVCRUNTIME ref: 00E73BA4

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 790102d0a8ff33583713ca2807e3faf9715b69697431f6dde7d0db505476014b
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: D9014C72100148BBDF125EA5CC46EEB7FADEF48758F049018FE5C66121C732E961EBA0

Function 00E83073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00E513C6,00000000,00000000,?,00E8301A,00E513C6,00000000,00000000,00000000,?,00E8328B,00000006,FlsSetValue), ref: 00E830A5
GetLastError.KERNEL32(?,00E8301A,00E513C6,00000000,00000000,00000000,?,00E8328B,00000006,FlsSetValue,00EF2290,FlsSetValue,00000000,00000364,?,00E82E46), ref: 00E830B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00E8301A,00E513C6,00000000,00000000,00000000,?,00E8328B,00000006,FlsSetValue,00EF2290,FlsSetValue,00000000), ref: 00E830BF

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 2547591a2cbe6d2980840f2fe984637f595f246c8e8a5c2fa3abc4e82fe6f727
Instruction ID: 757dc8b37b3ce192f5c06fdfe0a855dbc7de9086713145922dbacb8a543aacea
Opcode Fuzzy Hash: 2547591a2cbe6d2980840f2fe984637f595f246c8e8a5c2fa3abc4e82fe6f727
Instruction Fuzzy Hash: E901F732302726AFCB315BBA9C84A677B98AF45F65B200720F90DF7150C721D906C7E0

Function 00EB7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00EB747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00EB7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00EB74AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00EB74CA

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 78fcaeb0454be4511ba77d18982c3328296227413f40412cdd49f54d9dc392b0
Instruction ID: 238257903ca640b847845d7fb1d5e32a9f9b249940dfe3ec86504f08cc748a88
Opcode Fuzzy Hash: 78fcaeb0454be4511ba77d18982c3328296227413f40412cdd49f54d9dc392b0
Instruction Fuzzy Hash: D4118EB12053149FE7208F14EC48BD37BFCEB40B05F108569B6B6EA591D770E908DB50

Function 00EBB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00EBACD3,?,00008000), ref: 00EBB0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00EBACD3,?,00008000), ref: 00EBB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00EBACD3,?,00008000), ref: 00EBB0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00EBACD3,?,00008000), ref: 00EBB126

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 572a04dbac6c0915965f1ef361731f586bf6554de93705503d924ee7327aa6da
Instruction ID: 34e7fb11b2e7cb1edc85505a56ebf18f0dedf639e894ee7f49ee4b984215d835
Opcode Fuzzy Hash: 572a04dbac6c0915965f1ef361731f586bf6554de93705503d924ee7327aa6da
Instruction Fuzzy Hash: B6116D31C0252CEBCF04AFE9E9A86FFBB78FF0A711F115085E941B6281CBB096518B51

Function 00EE7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00EE7E33
ScreenToClient.USER32(?,?), ref: 00EE7E4B
ScreenToClient.USER32(?,?), ref: 00EE7E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00EE7E8A

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: eb1e6bad4ff60736bb1b6001b46324d45407d67d6fa209cfbd037d20bd618932
Instruction ID: 02fb6bb2dd30b5c406f7f1c70871fd41692cd20a745d26ca22817f44a094f78d
Opcode Fuzzy Hash: eb1e6bad4ff60736bb1b6001b46324d45407d67d6fa209cfbd037d20bd618932
Instruction Fuzzy Hash: 891143B9D0024EAFDB41CFA9D8849EEBBF5FB08310F505066E915E2210D735AA55CF50

Function 00EB2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00EB2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00EB2DD6
GetCurrentThreadId.KERNEL32 ref: 00EB2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00EB2DE4

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 278e1bc16984cd8e8875c5b024d9bf7af0f46b09e13a205c01743647affaa8e6
Instruction ID: 24309e65b97c00e54805847247d3574d5078e4abec5b52a3768fc0f2e1f8d120
Opcode Fuzzy Hash: 278e1bc16984cd8e8875c5b024d9bf7af0f46b09e13a205c01743647affaa8e6
Instruction Fuzzy Hash: E1E09272101228BFDB201B73AC4DFEB3E6CEF42FA1F101019F206F50809AA0C886C6B0

Function 00EE8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00E69639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00E69693
Part of subcall function 00E69639: SelectObject.GDI32(?,00000000), ref: 00E696A2
Part of subcall function 00E69639: BeginPath.GDI32(?), ref: 00E696B9
Part of subcall function 00E69639: SelectObject.GDI32(?,00000000), ref: 00E696E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00EE8887
LineTo.GDI32(?,?,?), ref: 00EE8894
EndPath.GDI32(?), ref: 00EE88A4
StrokePath.GDI32(?), ref: 00EE88B2

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: a0b8859af05cf3f7d352778e96456fb734afdd27f6aede4f56520d8f1cc787c4
Instruction ID: 832fb070374650e4dec13133a63bea49106cd5ce2783c80bae332c7433ce9c4c
Opcode Fuzzy Hash: a0b8859af05cf3f7d352778e96456fb734afdd27f6aede4f56520d8f1cc787c4
Instruction Fuzzy Hash: 3FF03A3604129CBADB125F95AC09FCE3A69AF16314F548000FE11790E2C7755556DBE9

Function 00E698B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00E698CC
SetTextColor.GDI32(?,?), ref: 00E698D6
SetBkMode.GDI32(?,00000001), ref: 00E698E9
GetStockObject.GDI32(00000005), ref: 00E698F1

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 8b59bc44528b65c42776a406f53bacc20b1f731c54043f673ae6c550989290f3
Instruction ID: 515b8ff01c33a5707db284fb3fde6bb82cabe17b66669f7689678b9ce9a917f4
Opcode Fuzzy Hash: 8b59bc44528b65c42776a406f53bacc20b1f731c54043f673ae6c550989290f3
Instruction Fuzzy Hash: 27E0E531240284AEDB204B35FC08BD83F20EB06336F148219F6F96C0E1C37146459B10

Function 00EB162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00EB1634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00EB11D9), ref: 00EB163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00EB11D9), ref: 00EB1648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00EB11D9), ref: 00EB164F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: b71bb96dd3f2f91fc2f3f24e5984f785a603ca3f2bdef1d3c76213f041ac4002
Instruction ID: e95e79670d8fb84011fe0936ce29918ccbd5b53114efe9dcc305573d912ce2a6
Opcode Fuzzy Hash: b71bb96dd3f2f91fc2f3f24e5984f785a603ca3f2bdef1d3c76213f041ac4002
Instruction Fuzzy Hash: 9EE08631601215DFD7201FA6AD4DB873B7CAF447A5F244848F645ED090E734444AC750

Function 00EAD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00EAD858
GetDC.USER32(00000000), ref: 00EAD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00EAD882
ReleaseDC.USER32(?), ref: 00EAD8A3

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 41906b8159c434bb94360f50524b8962ea7d2a45baf36132cae4ef451c6b74b8
Instruction ID: 97bb2d64c1bebefa031fa9baaaa185612f68cd427318d2e7c5c62184af3fbc75
Opcode Fuzzy Hash: 41906b8159c434bb94360f50524b8962ea7d2a45baf36132cae4ef451c6b74b8
Instruction Fuzzy Hash: 09E0E5B4904209DFCF419FA59C4866EBBB2AB48711B249409F816BB250C738590AAF50

Function 00EAD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00EAD86C
GetDC.USER32(00000000), ref: 00EAD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00EAD882
ReleaseDC.USER32(?), ref: 00EAD8A3

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 60937676674122d5b89c7734149063a9111b834884951c56667ba5f6d6d535b7
Instruction ID: 8435ae7acec0f24a1a40befdcbe66d947dbe482873776d33b6d2794b6896eb9f
Opcode Fuzzy Hash: 60937676674122d5b89c7734149063a9111b834884951c56667ba5f6d6d535b7
Instruction Fuzzy Hash: 3BE01A74D00209DFCF409FA5DC4C66EBBF1BB48711B249408F816FB250C738590A9F50

Function 00EC4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00E57620: _wcslen.LIBCMT ref: 00E57625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00EC4ED4

Strings

*, xrefs: 00EC4E10
LPT, xrefs: 00EC4DFB

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: be08e827ff4bbad6fdea54a4e45cdaf0e707c72029e5b0283973a429df810b44
Instruction ID: fa9489b19dd78d088fb22234dce9a0db02120747f2662d240d11690943da38ea
Opcode Fuzzy Hash: be08e827ff4bbad6fdea54a4e45cdaf0e707c72029e5b0283973a429df810b44
Instruction Fuzzy Hash: 5E9170B5A002449FCB14DF54C594FA9BBF1AF44308F15A09DE846AF392D732ED86CB50

Function 00E7E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00E7E30D

Strings

pow, xrefs: 00E7E2E5, 00E7E302

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: b3a79523b3d2352e48b0feb68ab6c0ee77d8ebaedfdd70187cf028f765820b85
Instruction ID: c278252dc75d5ddeecaaa9c6d14746d3b1f133d4b7d35b4e95dd71215443ea32
Opcode Fuzzy Hash: b3a79523b3d2352e48b0feb68ab6c0ee77d8ebaedfdd70187cf028f765820b85
Instruction Fuzzy Hash: 14512661A1C202A6CB167714C9013BA3BA4AB85744F34E9DCE0DDB33E9EB35CC95DB46

Function 00E6E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00E6E1B1

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 43bd41e4bf43000f7fe59cd3fb5df8ce751904450e925b3222c25fe15e8a8cdf
Instruction ID: 97079d928e026b35f9c3b89dbf1fe0da6fcf46b9e8f7da17756a2e72158f20e9
Opcode Fuzzy Hash: 43bd41e4bf43000f7fe59cd3fb5df8ce751904450e925b3222c25fe15e8a8cdf
Instruction Fuzzy Hash: D9513079500246DFDB18DF68D0916FA7BA9EF1A314F246016F891BF3D0DA34AD46CBA0

Function 00E6F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00E6F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00E6F2BB

Strings

@, xrefs: 00E6F2AF

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 59fba33eb1bfd00931ef354bd45ea72e72de607c4d99eaa3e13a502274fd0d42
Instruction ID: 8c0c69358e53458e6e76d865fa41e3c90a38fe659f306e3e799476c9ac9212dc
Opcode Fuzzy Hash: 59fba33eb1bfd00931ef354bd45ea72e72de607c4d99eaa3e13a502274fd0d42
Instruction Fuzzy Hash: 645155715087489BD320AF10EC96BAFBBF8FB84301F91884CF5D9511A5EB308529CB66

Function 00ED5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00ED57E0
_wcslen.LIBCMT ref: 00ED57EC

Strings

CALLARGARRAY, xrefs: 00ED57E6, 00ED57EB

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 396460dff8a903101d15c1b54f57769534f73923ca3f99f59e2660f6905ca68c
Instruction ID: 8fb27b8c7f3858314b6aa7e47795dfafa9557518563f8c7b501344613783cdab
Opcode Fuzzy Hash: 396460dff8a903101d15c1b54f57769534f73923ca3f99f59e2660f6905ca68c
Instruction Fuzzy Hash: 33419236A002099FCB18DFA9C8828EEBBF5FF59354F10606AE515B7391D7349D82DB50

Function 00ECD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00ECD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00ECD13A

Strings

|, xrefs: 00ECD10B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 5fbdaf216e4d713e55f2f0c8aa210c72fe98f74a88f385e99e41ecf8bd99b249
Instruction ID: 7dff804e02b4347ce579abbf9db783999b6281c858ae961f55e81f26ffff1683
Opcode Fuzzy Hash: 5fbdaf216e4d713e55f2f0c8aa210c72fe98f74a88f385e99e41ecf8bd99b249
Instruction Fuzzy Hash: 3D31F871D01119ABCF15EFA4CD85AEE7BB9FF04304F141029F915B6166DA32AA46CB50

Function 00EE356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00EE3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00EE365C

Strings

static, xrefs: 00EE35BC

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 69c09e518288db05dc655ffd922d98f22914a6ed982c7150a082cdc4e63a4724
Instruction ID: 951210b01bc675de0d014e8b5a7943eca35d80d206f29bd562f5804d0df51019
Opcode Fuzzy Hash: 69c09e518288db05dc655ffd922d98f22914a6ed982c7150a082cdc4e63a4724
Instruction Fuzzy Hash: B831A471100248AEDB20DF35DC85EFB73A9FF48764F10A619F865E7280DA31AD85D760

Function 00EE4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00EE461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00EE4634

Strings

', xrefs: 00EE458E

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 359bcc39b43d4dba94d417f5c381b7e7f61fab9df31c2078f4408959afeff257
Instruction ID: 6a1b66a6e3c77f689ad4add6e09cbb186894e72c0cb9c690da9ed6c248315e9d
Opcode Fuzzy Hash: 359bcc39b43d4dba94d417f5c381b7e7f61fab9df31c2078f4408959afeff257
Instruction Fuzzy Hash: CD3138B4A0034E9FDB14CFAAC980BDABBB5FF09304F14506AE904AB381D770A945CF90

Function 00EE31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00EE327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00EE3287

Strings

Combobox, xrefs: 00EE3249

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: a43f5aae304b165714d979161e89c820435de1294ab72ecffc68a8f791c4bcc4
Instruction ID: 4f6ccec54a34c77f2291e37dee0ef6d78eea02fd6387ff8ed6ecee177880fa0c
Opcode Fuzzy Hash: a43f5aae304b165714d979161e89c820435de1294ab72ecffc68a8f791c4bcc4
Instruction Fuzzy Hash: BF11E27130024C7FEF219EA5DC88EFB37ABEB98368F101524FA58A72A0D631DD519760

Function 00EE3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00E5600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00E5604C
Part of subcall function 00E5600E: GetStockObject.GDI32(00000011), ref: 00E56060
Part of subcall function 00E5600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E5606A

GetWindowRect.USER32(00000000,?), ref: 00EE377A
GetSysColor.USER32(00000012), ref: 00EE3794

Strings

static, xrefs: 00EE3757

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: bb25171ae38a1a82a0735ca82772f9aa4f95b34591f5fe94b6f3b2d4b8514703
Instruction ID: 95b459e5286dfd097ad720ce2ccfce34785bd9b69f367272e7d4302600c1c290
Opcode Fuzzy Hash: bb25171ae38a1a82a0735ca82772f9aa4f95b34591f5fe94b6f3b2d4b8514703
Instruction Fuzzy Hash: 471144B261024AAFDF10DFB9CC4AAEA7BB9EB08314F005925F955E3250E734E8159B60

Function 00ECCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00ECCD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00ECCDA6

Strings

<local>, xrefs: 00ECCD66

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: a8a82df0c67c4a0f7b078636c6a7272c2e14db35bdf96a84709de2615f37be8f
Instruction ID: ab5abb26ca7a596b5e8a3a75dbdbfa647dfa93a3ba3576dfd85fb04b24b273f2
Opcode Fuzzy Hash: a8a82df0c67c4a0f7b078636c6a7272c2e14db35bdf96a84709de2615f37be8f
Instruction Fuzzy Hash: E1110A7150163579D7344B668C44FE3BE6CEF127A4F20522EF10EA3180D3719882D6F0

Function 00EE3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00EE34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00EE34BA

Strings

edit, xrefs: 00EE348F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 07043f0d3112f2effe77d389b55629416f11e86190e15258a0b5005913d519eb
Instruction ID: 322b9949f6cb718d8650aaa32f1c036e35b1199b241e6cd0d54716bf12771dc0
Opcode Fuzzy Hash: 07043f0d3112f2effe77d389b55629416f11e86190e15258a0b5005913d519eb
Instruction Fuzzy Hash: FE11BF7110028CAFEB224E76DC88AEB37AAEB05378F606724F970A71D0C731DD559B50

Function 00EB6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

CharUpperBuffW.USER32(?,?,?), ref: 00EB6CB6
_wcslen.LIBCMT ref: 00EB6CC2

Strings

STOP, xrefs: 00EB6CBC, 00EB6CC1

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 93324e399f1218d16cd666cdb98d65a0e3c943db6d3851014cc35d875cd6585b
Instruction ID: 83c194d0b3d4e4b7ffb0cc12ed12ae7a08ba3f5f0ff617f8ea157279f4252abe
Opcode Fuzzy Hash: 93324e399f1218d16cd666cdb98d65a0e3c943db6d3851014cc35d875cd6585b
Instruction Fuzzy Hash: 710104326005278BCB20AFBDDC919FFB7F5EB607147101934E852B6191EB39D844CA50

Function 00EB1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

Part of subcall function 00EB3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EB3CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00EB1D4C

Strings

ListBox, xrefs: 00EB1D16
ComboBox, xrefs: 00EB1CEB

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: b0ed00d00f2d3824121b05704207d2f6a695c99fbc681f8301769d316e123074
Instruction ID: dc2ed336e78f6158a333ab646d96e02d40ee5318fe17ca2023728e693824034b
Opcode Fuzzy Hash: b0ed00d00f2d3824121b05704207d2f6a695c99fbc681f8301769d316e123074
Instruction Fuzzy Hash: D5012835600218EB8B08EBE0CC61CFFB7A8EB42361B501D19FC22772C2EA30590C8661

Function 00EB1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

Part of subcall function 00EB3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EB3CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00EB1C46

Strings

ListBox, xrefs: 00EB1C10
ComboBox, xrefs: 00EB1BE5

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 58abca342f684d6059070ffe73bf69a1fb4af5b9cdd59645f29ad942c4ba240a
Instruction ID: 6b97345c93895e63e51e18053d8a346b6da031660117766ab045294f753c646a
Opcode Fuzzy Hash: 58abca342f684d6059070ffe73bf69a1fb4af5b9cdd59645f29ad942c4ba240a
Instruction Fuzzy Hash: 1F01AC75641104A6CB08E7A0C963AFFBBE89B51750F541459B80677182EA249E0C9AB2

Function 00EB1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

Part of subcall function 00EB3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EB3CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00EB1CC8

Strings

ListBox, xrefs: 00EB1C94
ComboBox, xrefs: 00EB1C69

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 8aba1034242381b0673320e6b48bf81e8894e7c3f37d0730b8a4ecfcef2cae52
Instruction ID: 59907cb44b8b70e07555acbb3081295f6f0e9755b223663816affacd7bb2006f
Opcode Fuzzy Hash: 8aba1034242381b0673320e6b48bf81e8894e7c3f37d0730b8a4ecfcef2cae52
Instruction Fuzzy Hash: 3201FE75740118A7CB08E7A4CA12EFFFBEC9B11750F642415BC0173282EA219F0CDAB2

Function 00EB1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E59CB3: _wcslen.LIBCMT ref: 00E59CBD

Part of subcall function 00EB3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00EB3CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00EB1DD3

Strings

ListBox, xrefs: 00EB1DA0
ComboBox, xrefs: 00EB1D75

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 2238343c428128f337840ef252fdbf830c56c6f6d5d996b1ef138a27d7583f8f
Instruction ID: 4a05186eccf996082c65796f986a87d37485d20f585fbd0371427ce3ae41d25c
Opcode Fuzzy Hash: 2238343c428128f337840ef252fdbf830c56c6f6d5d996b1ef138a27d7583f8f
Instruction Fuzzy Hash: F6F0A975A41214A6D704E7A4CC52AFFB7B8AB41751F541D19B822772C2DA60590C86A1

Function 00ED747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00ED7493
_wcslen.LIBCMT ref: 00ED74B9

Strings

3, 3, 16, 1, xrefs: 00ED7483

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: d5e71e82cfb8c3eade15dd361e370df4eb23106264672a9b75c646f2ef3c6e99
Instruction ID: 5543e69905cb94383b994ae247cfc123aa439d0815959573cda64b13b094182a
Opcode Fuzzy Hash: d5e71e82cfb8c3eade15dd361e370df4eb23106264672a9b75c646f2ef3c6e99
Instruction Fuzzy Hash: CCE02B4220432111933223799CC197F5AC9CFC5750710382BFAD9E23AAFB94CD9393A1

Function 00EB0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00EB0B23

Strings

AutoIt, xrefs: 00EB0B17
Error allocating memory., xrefs: 00EB0B1C

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: f7d992772555321ce1ed166431d523385a24566b5bf64906c955af523b928c71
Instruction ID: 24104bad037243f820324f57024c3ebe9067d1d1d7c3f6f64c017f6a4e77c5ec
Opcode Fuzzy Hash: f7d992772555321ce1ed166431d523385a24566b5bf64906c955af523b928c71
Instruction Fuzzy Hash: 0AE0D83128434C2BD21436557C43FC97BC48F05F65F201427FB58B95C38BE2689156AA

Function 00E70D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00E6F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00E70D71,?,?,?,00E5100A), ref: 00E6F7CE

IsDebuggerPresent.KERNEL32(?,?,?,00E5100A), ref: 00E70D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00E5100A), ref: 00E70D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00E70D7F

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 99a2fd33404fa742d8f5b6ca14439018f90c6bf4552f531678a8e1ffc0b926b3
Instruction ID: 05177933f065d48b15edfb7fb5743696c0beb626845984b08ebeded932828786
Opcode Fuzzy Hash: 99a2fd33404fa742d8f5b6ca14439018f90c6bf4552f531678a8e1ffc0b926b3
Instruction Fuzzy Hash: 65E06D702007818FD3309FB9E4453427BE0BB14745F00992DF58AEA661DBB0F4498B91

Function 00EC3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00EC302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00EC3044

Strings

aut, xrefs: 00EC3038

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: d6a80210f05a1dd97b50b75430c39225b323adbf7d9ed89fa8a890ca929da100
Instruction ID: c68917fd73b530a4024679b8d7803b6e375b84811529c93161977a8f07f72d23
Opcode Fuzzy Hash: d6a80210f05a1dd97b50b75430c39225b323adbf7d9ed89fa8a890ca929da100
Instruction Fuzzy Hash: C2D05B71500318ABDA2097959C4DFC73A6CDB04751F0001517755E60A1DAB4D585CAD0

Function 00EAD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00EAD220

Strings

X64, xrefs: 00EAD2A8
%.3d, xrefs: 00EAD22B

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 93abb4f8df03f217923cd55952a8d84e9533af34fedc26744684638a0ca7d0c1
Instruction ID: 4ce97168cbd7018348228ca25f3ab96d02ea24f98c4b32e4c4b6e1ce2893e023
Opcode Fuzzy Hash: 93abb4f8df03f217923cd55952a8d84e9533af34fedc26744684638a0ca7d0c1
Instruction Fuzzy Hash: 0AD012A1C4C109E9CB9096D0DC45AF9B3BCFB1D341F609452F907B5460E624E548E772

Function 00EE2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00EE236C
PostMessageW.USER32(00000000), ref: 00EE2373

Part of subcall function 00EBE97B: Sleep.KERNELBASE ref: 00EBE9F3

Strings

Shell_TrayWnd, xrefs: 00EE2365

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 5889f0f0c7b8f4337c91f96451eff6a49e4fd1c8323536912818ad74d7514dab
Instruction ID: 159abd7b85a5ed5084997f1e537ab3e34ea39c249cb6c7811566a24d2035fd43
Opcode Fuzzy Hash: 5889f0f0c7b8f4337c91f96451eff6a49e4fd1c8323536912818ad74d7514dab
Instruction Fuzzy Hash: 2BD0C936381354BEE664A7719C4FFC766549B44B10F1049167745FA1D0C9A0B84A8A55

Function 00EE2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00EE232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00EE233F

Part of subcall function 00EBE97B: Sleep.KERNELBASE ref: 00EBE9F3

Strings

Shell_TrayWnd, xrefs: 00EE2325

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 296e41739d0383715a0911d0d0c23bbad9f2684dff94519e5ae87c839a5cc29d
Instruction ID: 7be1bd7cebd4e7820993a1d0067e71ea3bd5b006f3f98285927cb7dcff109fcc
Opcode Fuzzy Hash: 296e41739d0383715a0911d0d0c23bbad9f2684dff94519e5ae87c839a5cc29d
Instruction Fuzzy Hash: 8BD0A936380340BAE264A3719C4FFC76A049B00B00F1009027305BA1D0C9A0A80A8A00

Function 00E8BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00E8BE93
GetLastError.KERNEL32 ref: 00E8BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00E8BEFC

Memory Dump Source

Source File: 00000000.00000002.3323762073.0000000000E51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E50000, based on PE: true

Associated: 00000000.00000002.3323739095.0000000000E50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000EEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323835762.0000000000F12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323891704.0000000000F1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3323911909.0000000000F24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e50000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 7ed3c7cca7aaea760a6fe55667990b684752dbb43b2910013e1d70834769ba8d
Instruction ID: a88097b3841ab697008ee742f27b2067e55016b1c7b0243e37081c2afdc2d3a1
Opcode Fuzzy Hash: 7ed3c7cca7aaea760a6fe55667990b684752dbb43b2910013e1d70834769ba8d
Instruction Fuzzy Hash: 7F41E93570424AAFCF21AFA5CC44ABA7BB5EF42714F246169FA5DBB1A1DB308D01CB50

Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=omkUsO6mR5ZdVXc&MD=alkXyk66 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=omkUsO6mR5ZdVXc&MD=alkXyk66 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.46

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\07416fbe-36d3-4e90-b456-2f47f8e44592.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\130bb43a-a24d-4323-bcde-7fcdbfc34939.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\24b45322-7dd4-4348-b37a-1c194b125813.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3feeda1d-c3b4-4051-bafe-401522c30cd5.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\44c1f198-425b-4357-9489-2b1a30f5c19a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\864fafab-8440-4bd8-a46d-bac33cd5dd08.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\90faf154-dfd7-4afd-ac91-6075dc78cb49.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\d48ce1cc-e8ec-44cb-b3fb-595df9a02242.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66CF5575-16DC.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66CF5576-448.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\261ebe91-24ce-4de8-b54b-df0e05e4f1e8.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\6b30307d-acb6-4abb-9f8d-1426b41b9432.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7529d1c5-64bf-4c9a-8ad1-1e15b21f3cc5.tmp

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre